Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.Patched.29806.7109.exe

Overview

General Information

Sample name:SecuriteInfo.com.Win32.Patched.29806.7109.exe
Analysis ID:1409007
MD5:cf15ed86315ab1a94996fb69ef157005
SHA1:92dfe7452e0a21e6b5da69f386603080eca9d7eb
SHA256:175eb4505659184198a6dacaf5c52bf80c9b10f168b081a07e3457058cc51e89
Tags:exe
Infos:

Detection

Score:52
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected Generic Python Ransomware
Found many strings related to Crypto-Wallets (likely being stolen)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Tries to load missing DLLs
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • SecuriteInfo.com.Win32.Patched.29806.7109.exe (PID: 6876 cmdline: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe MD5: CF15ED86315AB1A94996FB69EF157005)
    • SecuriteInfo.com.Win32.Patched.29806.7109.exe (PID: 6896 cmdline: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe MD5: CF15ED86315AB1A94996FB69EF157005)
      • cmd.exe (PID: 5812 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • conhost.exe (PID: 1188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 3616 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • conhost.exe (PID: 2500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 5804 cmdline: C:\Windows\system32\cmd.exe /c fsutil sparse setflag "C:\Users\user\Desktop\electrum_data\blockchain_headers" 1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • conhost.exe (PID: 5572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • fsutil.exe (PID: 3140 cmdline: fsutil sparse setflag "C:\Users\user\Desktop\electrum_data\blockchain_headers" 1 MD5: 452CA7574A1B2550CD9FF83DDBE87463)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
Process Memory Space: SecuriteInfo.com.Win32.Patched.29806.7109.exe PID: 6896JoeSecurity_GenericPythonRansomwareYara detected Generic Python RansomwareJoe Security

    Sigma Signatures

    ⊘No Sigma rule has matched

    Snort Signatures

    ⊘No Snort rule has matched

    Joe Sandbox Signatures

    Click to jump to signature section

    Show All Signature Results
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3555808606.000000006A670000.00000004.00000001.01000000.0000002A.sdmpBinary or memory string: -----BEGIN PUBLIC KEY-----memstr_437c4112-0
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DEBUG_STRIPPED
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\LICENSE.txtJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\revealer\LICENSE_DEJAVU.txtJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\revealer\SIL Open Font License.txtJump to behavior
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exeStatic PE information: certificate valid
    Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdbDD source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1699116063.0000000000C86000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\imageformats\qsvg.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698737621.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3552206505.00000000694A3000.00000002.00000001.01000000.00000035.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\iconengines\qsvgicon.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697709722.0000000000C88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: d:\agent\_work\1\s\\binaries\x86ret\bin\i386\\msvcp140_1.i386.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1672155859.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3559581415.000000006BAA1000.00000020.00000001.01000000.00000022.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\generic\qtuiotouchplugin.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697443975.0000000000C88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\audio\qtaudio_wasapi.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1696552484.0000000000C88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\audio\qtaudio_wasapi.pdb++" source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1696552484.0000000000C88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3560059190.000000006BF24000.00000002.00000001.01000000.00000020.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_decimal.pdb%% source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3565095672.000000006E3C2000.00000002.00000001.01000000.00000016.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1699116063.0000000000C86000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698317093.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3552751498.0000000069514000.00000002.00000001.01000000.00000033.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qgif.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697909092.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3553194207.0000000069535000.00000002.00000001.01000000.00000031.sdmp
    Source: Binary string: C:\Users\runneradmin\AppData\Local\Temp\pip-req-build-7mupx30s\src\rust\target\i686-pc-windows-msvc\release\deps\cryptography_rust.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3563103148.000000006C7A4000.00000002.00000001.01000000.00000019.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_queue.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3566802453.000000006F833000.00000002.00000001.01000000.0000000F.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtga.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698889410.0000000000C88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\python310.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3564515928.000000006CF34000.00000002.00000001.01000000.00000005.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\bearer\qgenericbearer.pdb"" source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697199492.0000000000C88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_overlapped.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3566422653.000000006F815000.00000002.00000001.01000000.00000014.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\sqlite3.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3561745530.000000006C341000.00000002.00000001.01000000.0000001E.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qicns.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698162870.0000000000C88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qgif.pdb!! source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697909092.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3553194207.0000000069535000.00000002.00000001.01000000.00000031.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_sqlite3.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3562034683.000000006C379000.00000002.00000001.01000000.0000001D.sdmp
    Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3563103148.000000006C7A4000.00000002.00000001.01000000.00000019.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwebp.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1699519349.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3551072342.00000000693B7000.00000002.00000001.01000000.0000003A.sdmp
    Source: Binary string: &}lalgorpublic_keyX509_PUBKEYcrypto\x509\x_pubkey.cx509_pubkey_ex_new_exx509_pubkey_ex_d2i_exDERX509_PUBKEY_setx509_pubkey_decodeX509_PUBKEY_get0X509_PUBKEY_getPrivateKeyInfodo_pk8pkeycrypto\pem\pem_pk8.cd2i_PKCS8PrivateKey_bioENCRYPTED PRIVATE KEYPRIVATE KEYpem_read_bio_key_decodercrypto\pem\pem_pkey.cANY PRIVATE KEYPARAMETERSpem_read_bio_key_legacyPEM_write_bio_PrivateKey_traditional%s PRIVATE KEYtype-specificcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.2.1built on: Fri Feb 16 00:14:00 2024 UTCplatform: VC-WIN32OPENSSLDIR: "C:\Program Files (x86)\Common Files\SSL"ENGINESDIR: "C:\Program Files (x86)\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files (x86)\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3563103148.000000006C7A4000.00000002.00000001.01000000.00000019.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\pyexpat.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3567006629.000000006F85F000.00000002.00000001.01000000.0000000E.sdmp
    Source: Binary string: lblobi2d_providedcrypto\asn1\i2d_evp.ci2d_PrivateKeycrypto\passphrase.cossl_pw_set_passphraseossl_pw_set_pem_password_cbossl_pw_set_ossl_passphrase_cbossl_pw_set_ui_methoddo_ui_passphrasepass phraseossl_pw_get_passphrasePrompt info data type incorrectNo password method specifiedPVKcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllcrypto\initthread.cOPENSSL_ia32capp? source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3563103148.000000006C7A4000.00000002.00000001.01000000.00000019.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb"" source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698317093.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3552751498.0000000069514000.00000002.00000001.01000000.00000033.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\python3.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3550916655.0000000010000000.00000002.00000001.01000000.00000007.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\audio\qtaudio_windows.pdb(( source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1696877063.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1696823107.0000000000C88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3564030118.000000006CB54000.00000002.00000001.01000000.00000011.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\select.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3567231236.000000006F873000.00000002.00000001.01000000.0000000D.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\bearer\qgenericbearer.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697199492.0000000000C88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\generic\qtuiotouchplugin.pdb"" source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697443975.0000000000C88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdbU source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3560059190.000000006BF24000.00000002.00000001.01000000.00000020.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_asyncio.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3566609369.000000006F827000.00000002.00000001.01000000.00000013.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_decimal.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3565095672.000000006E3C2000.00000002.00000001.01000000.00000016.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qjpeg.pdbTT source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698495365.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3552434786.0000000069506000.00000002.00000001.01000000.00000034.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\unicodedata.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3563457421.000000006C9CC000.00000002.00000001.01000000.00000017.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\audio\qtaudio_windows.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1696877063.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1696823107.0000000000C88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qjpeg.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698495365.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3552434786.0000000069506000.00000002.00000001.01000000.00000034.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwbmp.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1699312188.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3551301360.00000000693D3000.00000002.00000001.01000000.00000039.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_socket.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3567447950.000000006F888000.00000002.00000001.01000000.0000000C.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\libEGL.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1688256246.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3554291265.0000000069FB3000.00000002.00000001.01000000.0000002E.sdmp
    Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 1.1.1t 7 Feb 2023built on: Thu Feb 9 15:27:35 2023 UTCplatform: VC-WIN32OPENSSLDIR: "C:\Program Files (x86)\Common Files\SSL"ENGINESDIR: "C:\Program Files (x86)\OpenSSL\lib\engines-1_1"not available source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3564030118.000000006CB54000.00000002.00000001.01000000.00000011.sdmp
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 0_2_00408F20 FindFirstFileExW,FindClose,0_2_00408F20
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 2_2_00408F20 FindFirstFileExW,FindClose,2_2_00408F20
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\audio\Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\bearer\Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Jump to behavior
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3543678133.0000000003CF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://.../back.jpeg
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1821392119.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1769676147.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1796126447.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1799437386.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1780063226.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1773045537.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1749986367.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1767754138.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1805050969.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1763692486.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1792408282.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1796103622.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1786718277.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1804999359.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1751347454.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1814590663.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1773065571.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1753795626.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1751363749.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1758186181.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1761141855.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.jqueryui.com/category/theming/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3542697776.00000000036E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://bugs.python.org/issue1230540
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1685146112.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiC
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1689458044.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702946052.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1674032284.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1679412385.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1689458044.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1683508323.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702301378.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1688314579.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697250264.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697199492.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698933269.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1679362249.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1701792452.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1683435047.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1675169264.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698889410.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1688256246.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698162870.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702716593.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1696877063.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1675169264.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1689458044.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1674032284.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1679412385.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1689458044.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697199492.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1679362249.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698889410.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698162870.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1696877063.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1675169264.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697963952.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1676214335.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698351299.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702946052.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698784942.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1701344824.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702480711.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1699312188.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698737621.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1678777556.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697709722.0000000000C88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702946052.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1674032284.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1689458044.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702301378.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1688314579.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697250264.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697199492.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698933269.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1679362249.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1701792452.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1675169264.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1688256246.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702716593.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1696877063.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1676214335.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1699360304.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698351299.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702946052.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1701344824.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1682000206.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1674032284.0000000000C8F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1878428289.00000000031F2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1879559468.0000000002F14000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1878559946.0000000002F14000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1879410565.0000000002F3D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577916/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1748343252.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1748326006.0000000000C87000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://creativecommons.org/publicdomain/zero/1.0/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1822600547.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1689458044.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1689458044.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697250264.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697199492.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1679362249.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698889410.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1675169264.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697963952.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1676214335.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698351299.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702946052.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698784942.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702480711.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1699312188.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698737621.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697709722.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1677826712.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1699519349.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1677865981.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698495365.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1699543285.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702946052.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1674032284.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1679412385.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1689458044.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1683508323.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702301378.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1688314579.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697250264.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697199492.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698933269.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1679362249.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1701792452.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1683435047.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1675169264.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1688256246.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698162870.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702716593.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1696877063.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1675169264.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1696877063.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697963952.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1682000206.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1681949738.0000000000C88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-a
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1689458044.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702946052.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1674032284.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1679412385.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1689458044.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1683508323.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697199492.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1679362249.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1683435047.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698889410.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698162870.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1696877063.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1675169264.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697963952.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1676214335.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698351299.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702946052.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698784942.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1701344824.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702480711.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1699312188.0000000000C88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702946052.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1674032284.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1689458044.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702301378.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1688314579.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697250264.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697199492.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698933269.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1679362249.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1701792452.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1675169264.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1688256246.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702716593.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1696877063.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1676214335.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1699360304.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698351299.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702946052.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1701344824.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1682000206.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1674032284.0000000000C8F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1689458044.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702946052.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1674032284.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1679412385.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1689458044.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1683508323.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702301378.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1688314579.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697250264.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697199492.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698933269.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1679362249.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1701792452.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1683435047.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1675169264.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698889410.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1688256246.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698162870.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702716593.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1696877063.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1675169264.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1689458044.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702946052.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1674032284.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1679412385.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1689458044.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1683508323.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697199492.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1679362249.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1683435047.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698889410.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698162870.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1696877063.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1675169264.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697963952.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1676214335.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698351299.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702946052.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698784942.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1701344824.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702480711.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1699312188.0000000000C88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702946052.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1674032284.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1689458044.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702301378.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1688314579.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697250264.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697199492.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698933269.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1679362249.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1701792452.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1675169264.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1688256246.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702716593.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1696877063.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1676214335.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1699360304.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698351299.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702946052.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1701344824.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1682000206.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1674032284.0000000000C8F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1895376844.000000000331D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf);
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3541627817.0000000002FF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1896214508.0000000003222000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1822030201.0000000000C88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://dejavu.sourceforge.net/wiki/index.php/License
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1822030201.0000000000C88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://dejavu.sourceforge.net/wiki/index.php/Licensehttp://dejavu.sourceforge.net/wiki/index.php/Lic
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1921471224.0000000003E9C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.electrum.org/r
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3542607867.0000000003640000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3542213988.00000000033E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/library/itertools.html#recipes
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3543851792.0000000003FD3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://en.wikipede
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3542213988.00000000033E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/ActiveState/appdirs
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1891003827.0000000003378000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1894277891.0000000003375000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1892334211.0000000003378000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1891003827.0000000003378000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/mail
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1892334211.000000000335C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/mail/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1894277891.0000000003375000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1892334211.0000000003378000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1891003827.0000000003378000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1894277891.0000000003375000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3540967311.0000000000879000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1892334211.0000000003378000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1891003827.0000000003378000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://httpbin.org/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1894277891.000000000331D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1891579280.000000000331D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1895376844.000000000331D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://httpbin.org/post
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1748197226.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1748213876.0000000000C87000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jacek.jedrzejewski.name)
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1821392119.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1769676147.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1796126447.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1799437386.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1780063226.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1773045537.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1749986367.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1767754138.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1805050969.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1763692486.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1792408282.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1796103622.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1786718277.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1804999359.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1751347454.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1814590663.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1773065571.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1753795626.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1751363749.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1758186181.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1761141855.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jquery.org/license
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1821392119.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1749721154.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1769676147.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1767561669.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1782407679.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1796126447.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1799437386.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1780063226.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1775184828.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1821152843.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1765432851.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1773045537.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1751192021.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1749986367.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1750185245.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1769494179.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1767754138.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1805050969.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1795911835.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1763692486.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1792408282.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1748197226.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1748213876.0000000000C87000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/about
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1749986367.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1749309140.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1749290929.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1749939373.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/themeroller/?bgShadowXPos=&bgOverlayXPos=&bgErrorXPos=&bgHighlightXPos=&bgConten
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1751192021.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1751347454.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1751363749.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1751174399.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Arial%2CHelvetica%2Csans-serif&fsDefault=1em&fwDefault=no
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1755343234.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1755614063.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Arial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerR
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1763692486.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1763451882.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1763673008.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1763431788.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Arial%2Csans-serif&fwDefault=bold&fsDefault=1.3em&cornerR
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1805050969.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1804999359.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1804704266.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1804730472.0000000000C87000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Georgia%2CVerdana%2CArial%2Csans-serif&fwDefault=bold&fsD
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1773045537.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1772246536.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1773065571.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1772197886.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Gill%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1769676147.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1769494179.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1821392119.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1775184828.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1821152843.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1775371549.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=normal&fsDefault
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1765432851.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1789115226.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1758005243.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1758186181.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1789410273.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1777644554.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1765797630.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1757983294.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1758167117.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1777474778.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1765453669.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1765774631.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1802104747.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1802329035.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1810270232.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1810048169.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1802129205.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1802352514.0000000000C87000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CArial%2Csans-serif&fwDefault=bold&fsDefault=
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1780063226.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1779714584.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1807548191.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1807754519.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1779658379.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1780114222.0000000000C87000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CHelvetica%2CArial%2Csans-serif&fwDefault=bol
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1782407679.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1782733524.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CHelvetica%2CArial%2Csans-serif&fwDefault
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1786718277.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1814590663.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1786428429.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1786455433.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1786694345.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1814250095.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CTahoma%2CVerdana%2CArial%2Csans-serif&fw
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1799437386.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1792408282.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1753795626.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1760813864.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1761141855.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1799413081.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1753773406.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1799174464.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1799150347.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1753588012.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1792127183.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1753564833.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1767561669.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1796126447.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1767754138.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1795911835.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1796103622.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1767537923.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1767775056.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1795890367.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=segoe%20ui%2CArial%2Csans-serif&fwDefault=bold&fsDefault=
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://mynode.local:3002/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1689458044.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702946052.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1674032284.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1679412385.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1689458044.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1683508323.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702301378.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1688314579.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697250264.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697199492.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698933269.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1679362249.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1701792452.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1683435047.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1675169264.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698889410.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1688256246.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698162870.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702716593.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1696877063.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1675169264.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1689458044.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1674032284.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1679412385.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1689458044.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697199492.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1679362249.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698889410.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698162870.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1696877063.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1675169264.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697963952.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1676214335.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698351299.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702946052.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698784942.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1701344824.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702480711.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1699312188.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698737621.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1678777556.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697709722.0000000000C88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0N
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702946052.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1674032284.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1689458044.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702301378.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1688314579.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697250264.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697199492.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698933269.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1679362249.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1701792452.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1675169264.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1688256246.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702716593.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1696877063.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1676214335.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1699360304.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698351299.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702946052.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1701344824.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1682000206.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1674032284.0000000000C8F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0O
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1822600547.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.thawte.com0
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3541718331.0000000003090000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1896214508.0000000003222000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://python.org/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1822550374.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1822798706.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1822600547.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1822600547.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sc.symcb.com/sc.crl0W
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1822550374.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1822798706.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1822600547.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1822600547.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sc.symcb.com/sc.crt0
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1822550374.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1822798706.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1822600547.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1822600547.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sc.symcd.com0&
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1821823243.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stackoverflow.com/questi
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1821823243.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stackoverflow.com/questi---
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1821823243.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1821879495.0000000000C8F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stackoverflow.com/questions/18729405/how-to-convert-utf8-string-to-byte-array
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1747616779.0000000000C90000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1747674346.0000000000C90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stackoverflow.com/questions/29186154/chrome-clicking-mailto-links-closes-websocket-connection
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3546927688.0000000004730000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://stackoverflow.com/questions/5176691/argparse-how-to-specify-a-default-subcommand
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3541718331.0000000003090000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1822600547.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1822600547.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1822600547.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-ocsp.ws.symantec.com07
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1870663174.0000000002EE2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1871139889.0000000002EE6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3543851792.0000000003DB0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comhttp://www.fontbureau.com/designersNormalNormaaliNormalNorm
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1896214508.0000000003222000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1896214508.0000000003222000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1870663174.0000000002EE2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1871139889.0000000002EE6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3543851792.0000000003FD3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3540967311.0000000000879000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/Microsoft
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3542697776.00000000036E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.lincolnloop.com
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1830890449.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.opensource.org/licenses/mit-license.php
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1696316170.0000000000C88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.openssl.org/V
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1870663174.0000000002EE2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1871139889.0000000002EE6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1822550374.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1822600547.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.symauth.com/cps0(
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1822550374.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1822600547.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.symauth.com/rpa04
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1894277891.0000000003375000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1896214508.0000000003222000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1892334211.0000000003378000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wwwsearch.sf.net/):
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1893873907.0000000003DD1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://xmr.link
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1894277891.0000000003375000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1892334211.0000000003378000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1891003827.0000000003378000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://yahoo.com/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://3xpl.com/bitcoin/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1746876620.0000000000C87000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://EditorConfig.org
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3546846006.00000000046F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.trustedcoin.com/#/electrum-help
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1840141986.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3550361040.0000000005A60000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.trustedcoin.com/2/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://blockchain.com/btc/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://blockchair.com/bitcoin/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://blockstream.info/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://blockstream.info/testnet/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://btc.bitaps.com/r
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://btc.com/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1896214508.0000000003222000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3542882830.00000000037F0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1891579280.000000000330E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bugs.python.org/issue37179
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3542697776.00000000036E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://bugs.python.org/issue42130
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3562441441.000000006C3BA000.00000002.00000001.01000000.0000001A.sdmpString found in binary or memory: https://cffi.readthedocs.io/en/latest/using.html#callbacks
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chainflyer.bitflyer.jp/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3563103148.000000006C7A4000.00000002.00000001.01000000.00000019.sdmpString found in binary or memory: https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1893873907.0000000003DD1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cryptoname.co/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1822550374.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1822600547.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d.symcb.com/cps0%
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1822550374.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1822600547.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d.symcb.com/rpa0
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3543678133.0000000003CF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://datatracker.ietf.org/doc/html/rfc5246#section-7.4.1.4.1
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1740588098.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1740623655.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://digitalbitbox.com/smartverification/index.php
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1896214508.0000000003222000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3542882830.00000000037F0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1891579280.000000000330E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.aiohttp.org/en/stable/client_advanced.html#proxy-support
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1880110113.0000000003202000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1896214508.0000000003222000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3542213988.00000000033E0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1881565761.000000000322D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/re.html
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1880110113.0000000003202000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/re.html#re.sub
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1891579280.000000000330E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3543243136.0000000003A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/ssl.html#ssl.OP_NO_COMPRESSION
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1921471224.0000000003E9C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://electrum.org
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ex.signet.bublina.eu.org/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://explorer.bc-2.jp/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3542165002.00000000033A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3543147586.0000000003980000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1742907613.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1742888863.0000000000C87000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Blockstream/Jade)
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1742907613.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1742888863.0000000000C87000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Blockstream/Jade/releases/tag/0.1.37).
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3550304032.0000000005A20000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/ColinDuquesnoy/QDarkStyleSheet/issues/200
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1746345465.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1746383785.0000000000C8F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/LedgerHQ/ledgercomm/blob/bc5ada865980cb63c2b9b71a916e01f2f8e53716/ledgercomm/inte
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1894277891.0000000003375000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1892334211.0000000003378000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1891003827.0000000003378000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Ousret/charset_normalizer
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3540967311.0000000000879000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1863040306.0000000000914000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1862588931.0000000000914000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1863349120.0000000000914000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1896214508.0000000003222000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3542882830.00000000037F0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1891579280.000000000330E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/aio-libs/aiohttp/discussions/6044
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1836788366.0000000000C89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/archos-safe-t/python-safet
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3543632767.0000000003CB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/bitcoin-core/HWI/blob/5f300d3dee7b317a6194680ad293eaa0962a3cc7/hwilib/key.py
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3543678133.0000000003CF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/bitcoin/bitcoin/blob/8cbc5c4be4be22aca228074f087a374a7ec38be8/src/script/script.h
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3545225242.00000000041B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/btcsuite/btcd/blob/fdc2bc867bda6b351191b5872d2da8270df00d13/txscript/scriptbuilde
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1748343252.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1748326006.0000000000C87000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/jquery/jquery-ui
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1744748979.0000000000C89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/keepkey/python-keepkey
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3543802712.0000000003D70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/keis/base58
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3545225242.00000000041B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyca/cryptography/issues
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3563103148.000000006C7A4000.00000002.00000001.01000000.00000019.sdmpString found in binary or memory: https://github.com/pyca/cryptography/issues/8996
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3563103148.000000006C7A4000.00000002.00000001.01000000.00000019.sdmpString found in binary or memory: https://github.com/pyca/cryptography/issues/9253
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3542213988.00000000033E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/packaging
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1895376844.00000000031C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pyparsing/pyparsing/wiki
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1894277891.000000000331D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1891579280.000000000331D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1895376844.000000000331D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/136
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1894277891.000000000331D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1891579280.000000000331D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1895376844.000000000331D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/428
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1863349120.0000000000914000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3540967311.0000000000879000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1863040306.0000000000914000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1862588931.0000000000914000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1863349120.0000000000914000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3542697776.00000000036E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/issues/86296
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1896214508.0000000003222000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3542882830.00000000037F0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1891579280.000000000330E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/pull/28073
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3543147586.0000000003980000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/romis2012/aiohttp-socks/issues/27
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3543243136.0000000003A10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/romis2012/python-socks
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3546846006.00000000046F0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1919458192.0000000003E9C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/satoshilabs/slips/blob/master/slip-0039.md.
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1896214508.0000000003222000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/scott-griffiths/bitstring
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3545225242.00000000041B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/spesmilo/electrum
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3543802712.0000000003D70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/spesmilo/electrum/issues
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1841824249.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/spesmilo/electrum/issues/6971)).
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1744484749.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1744411578.0000000000C89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/spesmilo/electrum/issues/7779
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3540967311.0000000000879000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1863040306.0000000000914000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1862588931.0000000000914000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1863349120.0000000000914000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1836184924.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/trezor/trezor-common/blob/44dfb07cfaafffada4b2ce0d15ba1d90d17cf35e/protob/types.p
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1837852595.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/trezor/trezor-firmware/issues/1167
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1838485058.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1836872184.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1836788366.0000000000C89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/trezor/trezor-mcu/pull/306
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1894277891.000000000331D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1891003827.000000000335C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1895376844.000000000331D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1892334211.000000000335C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1894277891.0000000003375000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3540967311.0000000000879000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1892334211.0000000003378000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1891003827.0000000003378000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3543102136.0000000003940000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/get
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1894277891.0000000003375000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1890033485.0000000003378000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1892334211.0000000003378000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1891003827.0000000003378000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/post
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://insight.bitpay.com/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1748343252.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1748326006.0000000000C87000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://jquery.org/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1896214508.0000000003222000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3540967311.0000000000879000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://json.org
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://live.blockcypher.com/btc-testnet/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://live.blockcypher.com/btc/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1896214508.0000000003222000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mahler:8092/site-updates.py
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mempool.emzy.de/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mempool.space/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mempool.space/signet/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mempool.space/testnet/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1893873907.0000000003DD1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://openalias.org
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://oxt.me/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1838400649.0000000000C89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/trezor/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3564515928.000000006CF34000.00000002.00000001.01000000.00000005.sdmpString found in binary or memory: https://python.org/dev/peps/pep-0263/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3542165002.00000000033A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3543678133.0000000003CF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1894277891.0000000003375000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1890033485.0000000003378000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1892334211.0000000003378000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1891003827.0000000003378000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://requests.readthedocs.io
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1823080241.0000000000C89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://revealer.cc/revealer-warning-and-upgrade/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1836788366.0000000000C89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://safe-t.io
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1873488031.0000000002EE2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884412932.0000000002EDA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1868464266.0000000002E9B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1872260409.0000000002EE2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1870663174.0000000002EE2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1874125303.0000000002EE2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1875641378.0000000002EE2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1871186479.0000000002EE2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1880226656.0000000002EDB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1876688827.0000000002EE2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1869198809.0000000002EE2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1740588098.0000000000C89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://shiftcrypto.ch/start
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://signet-explorer.wakiyamap.dev/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://signet.bitcoinexplorer.org/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3542697776.00000000036E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/a/13624858
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1880110113.0000000003202000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1896214508.0000000003222000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1881565761.000000000322D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/267399/how-do-you-match-only-valid-roman-numerals-with-a-regular
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1893873907.0000000003DD1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://swaps.electrum.org/api
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1893873907.0000000003DD1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://swaps.electrum.org/testnet
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tbtc.bitaps.com/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://testnet.smartbit.com.au/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1894277891.000000000331D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1891003827.000000000335C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1895376844.000000000331D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1892334211.000000000335C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1894277891.0000000003375000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3540967311.0000000000879000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1892334211.0000000003378000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1891003827.0000000003378000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1890390070.000000000338A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1890033485.0000000003378000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#https-proxy-error-http-proxy
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1890033485.0000000003378000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#ssl-warnings
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3541627817.0000000002FF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/stable/v2-migration-guide.html
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1894277891.000000000331D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1891003827.000000000335C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1895376844.000000000331D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1892334211.000000000335C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/html/sec-forms.html#multipart-form-data
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1838400649.0000000000C89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wallet.trezor.io
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884412932.0000000002EDA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1880226656.0000000002EDB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.debian.org/XDGBaseDirectorySpecification#state
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1894277891.000000000331D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1891579280.000000000331D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1895376844.000000000331D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.python.org/moin/DunderAlias
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3543102136.0000000003940000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.blockchain.com/btc-testnet/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.blockonomics.co/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.chain.so/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1689458044.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1689399656.0000000000C88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.6T6X6
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1689458044.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702946052.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1674032284.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1679412385.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1689458044.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1683508323.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702301378.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1688314579.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697250264.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697199492.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698933269.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1679362249.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1701792452.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1683435047.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1675169264.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698889410.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1688256246.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698162870.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702716593.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1696877063.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1675169264.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.com/CPS0
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1744748979.0000000000C89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.keepkey.com
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1894277891.0000000003375000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1890033485.0000000003378000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1892334211.0000000003378000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1891003827.0000000003378000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1896214508.0000000003222000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3541323690.0000000002DA0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1860146769.00000000008D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/dev/peps/pep-0205/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3542787700.0000000003770000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/dev/peps/pep-0506/
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1859499963.00000000008F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1859740884.000000000090C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1859629428.0000000000909000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1896214508.0000000003222000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://zopeinterface.readthedocs.io/en/latest/

    Spam, unwanted Advertisements and Ransom Demands

    barindex
    Yara detected Generic Python Ransomware
    Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.Win32.Patched.29806.7109.exe PID: 6896, type: MEMORYSTR
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 0_2_004099490_2_00409949
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 0_2_004131C00_2_004131C0
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 0_2_00410A200_2_00410A20
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 0_2_004145700_2_00414570
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 0_2_004095E60_2_004095E6
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 0_2_004095E60_2_004095E6
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 0_2_0040A6700_2_0040A670
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 0_2_0040AF900_2_0040AF90
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 2_2_004099492_2_00409949
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 2_2_004131C02_2_004131C0
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 2_2_00410A202_2_00410A20
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 2_2_004145702_2_00414570
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 2_2_004095E62_2_004095E6
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 2_2_004095E62_2_004095E6
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 2_2_0040A6702_2_0040A670
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 2_2_0040AF902_2_0040AF90
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 2_2_0506C3002_2_0506C300
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 2_2_050D95702_2_050D9570
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 2_2_04FFD4402_2_04FFD440
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 2_2_050675C02_2_050675C0
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 2_2_050674EB2_2_050674EB
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: String function: 00402ED0 appears 132 times
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: String function: 00402F90 appears 214 times
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: String function: 050DB1AD appears 75 times
    Source: _overlapped.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
    Source: unicodedata.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
    Source: libzbar-0.dll.0.drStatic PE information: Number of sections : 11 > 10
    Source: libusb-1.0.dll.0.drStatic PE information: Number of sections : 11 > 10
    Source: python3.dll.0.drStatic PE information: No import functions for PE file found
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1688314579.0000000000C86000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibEGL.dll. vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697250264.0000000000C86000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqgenericbe vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1671758696.0000000000C88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsvcp140.dllT vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1683435047.0000000000C88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5Svg.dll( vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698889410.0000000000C88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqtga.dll( vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1696316170.0000000000C88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamessleay32.dllH vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698162870.0000000000C88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqicns.dll( vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1672155859.0000000000C88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsvcp140_1.dllT vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1699312188.0000000000C88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqwbmp.dll( vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698194066.0000000000C86000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqicns.dll( vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698737621.0000000000C88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqsvg.dll( vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697709722.0000000000C88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqsvgicon.dll( vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1678711183.0000000000C88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5PrintSupport.dll( vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1699519349.0000000000C88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqwebp.dll( vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1696552484.0000000000C88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqtaudio_wasapi.dll( vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1699817125.0000000000C8F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamedsengine.dll( vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698544459.0000000000C86000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqjpeg.dll vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1702301378.0000000000C86000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqxdgdesktopportal.dll( vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1675128482.0000000000C88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5DBus.dll( vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1680601238.0000000000C88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5QmlModels.dll( vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1696823107.0000000000C88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqtaudio_windows.dll( vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698317093.0000000000C88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqico.dll( vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1688256246.0000000000C88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibEGL.dll. vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1680665226.0000000000C8F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5QmlModels.dll( vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1699083379.0000000000C88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqtiff.dll( vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697443975.0000000000C88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqtuiotouchplugin.dll( vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1683810184.0000000000C88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5WebSockets.dll( vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697909092.0000000000C88000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqgif.dll( vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exeBinary or memory string: OriginalFilename vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3567090532.000000006F867000.00000002.00000001.01000000.0000000E.sdmpBinary or memory string: OriginalFilenamepyexpat.pyd. vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3551624443.0000000069434000.00000002.00000001.01000000.00000038.sdmpBinary or memory string: OriginalFilenameqtiff.dll( vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3553062551.0000000069529000.00000002.00000001.01000000.00000032.sdmpBinary or memory string: OriginalFilenameqicns.dll( vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3552840308.0000000069518000.00000002.00000001.01000000.00000033.sdmpBinary or memory string: OriginalFilenameqico.dll( vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3552292543.00000000694A7000.00000002.00000001.01000000.00000035.sdmpBinary or memory string: OriginalFilenameqsvg.dll( vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3559781558.000000006BB1B000.00000002.00000001.01000000.00000021.sdmpBinary or memory string: OriginalFilenamemsvcp140.dllT vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3567584103.000000006F88F000.00000002.00000001.01000000.0000000C.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3554931582.000000006A4E0000.00000002.00000001.01000000.0000002C.sdmpBinary or memory string: OriginalFilenameqwindows.dll( vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3552073477.000000006948E000.00000002.00000001.01000000.00000036.sdmpBinary or memory string: OriginalFilenameQt5Svg.dll( vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3549656178.0000000005763000.00000002.00000001.01000000.00000025.sdmpBinary or memory string: OriginalFilenameQt5Gui.dll( vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3562149678.000000006C37F000.00000002.00000001.01000000.0000001D.sdmpBinary or memory string: OriginalFilename_sqlite3.pyd. vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3554122244.0000000069F93000.00000002.00000001.01000000.0000002F.sdmpBinary or memory string: OriginalFilenamelibGLESv2.dll4 vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3550916655.0000000010000000.00000002.00000001.01000000.00000007.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3551385142.00000000693D6000.00000002.00000001.01000000.00000039.sdmpBinary or memory string: OriginalFilenameqwbmp.dll( vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3566684063.000000006F82C000.00000002.00000001.01000000.00000013.sdmpBinary or memory string: OriginalFilename_asyncio.pyd. vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3566881209.000000006F836000.00000002.00000001.01000000.0000000F.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3563745742.000000006C9CE000.00000002.00000001.01000000.00000017.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3553503835.000000006955F000.00000002.00000001.01000000.00000030.sdmpBinary or memory string: OriginalFilenameqwindowsvistastyle.dll( vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3566500395.000000006F819000.00000002.00000001.01000000.00000014.sdmpBinary or memory string: OriginalFilename_overlapped.pyd. vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3567916478.000000006F8C2000.00000002.00000001.01000000.0000000B.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3558095724.000000006AC06000.00000002.00000001.01000000.00000027.sdmpBinary or memory string: OriginalFilenameQt5Widgets.dll( vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3566040158.000000006E61A000.00000002.00000001.01000000.00000015.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3551840986.0000000069446000.00000002.00000001.01000000.00000037.sdmpBinary or memory string: OriginalFilenameqtga.dll( vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3568651100.000000006F921000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3564968083.000000006D00C000.00000002.00000001.01000000.00000005.sdmpBinary or memory string: OriginalFilenamepython310.dll. vs SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: apphelp.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: version.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: vcruntime140.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: cryptsp.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: rsaenh.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: libffi-7.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: iphlpapi.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: libcrypto-1_1.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: libssl-1_1.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: mswsock.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: hid.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: sqlite3.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: qt5core.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: mpr.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: netapi32.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: winmm.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: msvcp140.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: msvcp140_1.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: srvcli.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: netutils.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: qt5gui.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: d3d11.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: dxgi.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: dxgi.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: qt5widgets.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: uxtheme.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: dwmapi.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: qt5multimedia.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: qt5network.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: qt5network.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: dnsapi.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: wtsapi32.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: windows.storage.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: wldp.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: powrprof.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: umpdc.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: d3d9.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: d3d10warp.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: opengl32.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: glu32.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: appxdeploymentclient.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: libegl.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: libglesv2.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: dcomp.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: resourcepolicyclient.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: d3d10warp.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: dxcore.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: qt5svg.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: dwrite.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: dataexchange.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: twinapi.appcore.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: textinputframework.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: coreuicomponents.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: coremessaging.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: ntmarta.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: coremessaging.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: wintypes.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: wintypes.dllJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeSection loaded: wintypes.dllJump to behavior
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DEBUG_STRIPPED
    Source: Qt5Core.dll.0.drStatic PE information: Section: .qtmimed ZLIB complexity 0.997458770800317
    Source: libsecp256k1-2.dll.0.drStatic PE information: Section: .rdata ZLIB complexity 0.998304429945055
    Source: classification engineClassification label: mal52.rans.spyw.winEXE@14/875@0/1
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 0_2_004086F0 FormatMessageW,WideCharToMultiByte,GetLastError,0_2_004086F0
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 2_2_04FF6DF0 ?loadResource@QTextDocument@@MAE?AVQVariant@@HABVQUrl@@@Z,??0QVariant@@QAE@$$QAV0@@Z,??0QVariant@@QAE@$$QAV0@@Z,??1QVariant@@QAE@XZ,2_2_04FF6DF0
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\Desktop\electrum_dataJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeMutant created: NULL
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2500:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1188:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5572:120:WilError_03
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762Jump to behavior
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3561745530.000000006C341000.00000002.00000001.01000000.0000001E.sdmpBinary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3561745530.000000006C341000.00000002.00000001.01000000.0000001E.sdmpBinary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3561745530.000000006C341000.00000002.00000001.01000000.0000001E.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3561745530.000000006C341000.00000002.00000001.01000000.0000001E.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3561745530.000000006C341000.00000002.00000001.01000000.0000001E.sdmpBinary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3561745530.000000006C341000.00000002.00000001.01000000.0000001E.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3561745530.000000006C341000.00000002.00000001.01000000.0000001E.sdmpBinary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile read: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeJump to behavior
    Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c fsutil sparse setflag "C:\Users\user\Desktop\electrum_data\blockchain_headers" 1
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\fsutil.exe fsutil sparse setflag "C:\Users\user\Desktop\electrum_data\blockchain_headers" 1
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c fsutil sparse setflag "C:\Users\user\Desktop\electrum_data\blockchain_headers" 1Jump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\fsutil.exe fsutil sparse setflag "C:\Users\user\Desktop\electrum_data\blockchain_headers" 1Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\InProcServer32Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile opened: C:\Users\user\Desktop\pyvenv.cfgJump to behavior
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exeStatic PE information: certificate valid
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exeStatic file information: File size 47825152 > 1048576
    Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdbDD source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1699116063.0000000000C86000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\imageformats\qsvg.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698737621.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3552206505.00000000694A3000.00000002.00000001.01000000.00000035.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\iconengines\qsvgicon.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697709722.0000000000C88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: d:\agent\_work\1\s\\binaries\x86ret\bin\i386\\msvcp140_1.i386.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1672155859.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3559581415.000000006BAA1000.00000020.00000001.01000000.00000022.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\generic\qtuiotouchplugin.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697443975.0000000000C88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\audio\qtaudio_wasapi.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1696552484.0000000000C88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\audio\qtaudio_wasapi.pdb++" source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1696552484.0000000000C88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3560059190.000000006BF24000.00000002.00000001.01000000.00000020.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_decimal.pdb%% source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3565095672.000000006E3C2000.00000002.00000001.01000000.00000016.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1699116063.0000000000C86000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698317093.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3552751498.0000000069514000.00000002.00000001.01000000.00000033.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qgif.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697909092.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3553194207.0000000069535000.00000002.00000001.01000000.00000031.sdmp
    Source: Binary string: C:\Users\runneradmin\AppData\Local\Temp\pip-req-build-7mupx30s\src\rust\target\i686-pc-windows-msvc\release\deps\cryptography_rust.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3563103148.000000006C7A4000.00000002.00000001.01000000.00000019.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_queue.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3566802453.000000006F833000.00000002.00000001.01000000.0000000F.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtga.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698889410.0000000000C88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\python310.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3564515928.000000006CF34000.00000002.00000001.01000000.00000005.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\bearer\qgenericbearer.pdb"" source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697199492.0000000000C88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_overlapped.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3566422653.000000006F815000.00000002.00000001.01000000.00000014.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\sqlite3.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3561745530.000000006C341000.00000002.00000001.01000000.0000001E.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qicns.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698162870.0000000000C88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qgif.pdb!! source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697909092.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3553194207.0000000069535000.00000002.00000001.01000000.00000031.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_sqlite3.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3562034683.000000006C379000.00000002.00000001.01000000.0000001D.sdmp
    Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3563103148.000000006C7A4000.00000002.00000001.01000000.00000019.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwebp.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1699519349.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3551072342.00000000693B7000.00000002.00000001.01000000.0000003A.sdmp
    Source: Binary string: &}lalgorpublic_keyX509_PUBKEYcrypto\x509\x_pubkey.cx509_pubkey_ex_new_exx509_pubkey_ex_d2i_exDERX509_PUBKEY_setx509_pubkey_decodeX509_PUBKEY_get0X509_PUBKEY_getPrivateKeyInfodo_pk8pkeycrypto\pem\pem_pk8.cd2i_PKCS8PrivateKey_bioENCRYPTED PRIVATE KEYPRIVATE KEYpem_read_bio_key_decodercrypto\pem\pem_pkey.cANY PRIVATE KEYPARAMETERSpem_read_bio_key_legacyPEM_write_bio_PrivateKey_traditional%s PRIVATE KEYtype-specificcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.2.1built on: Fri Feb 16 00:14:00 2024 UTCplatform: VC-WIN32OPENSSLDIR: "C:\Program Files (x86)\Common Files\SSL"ENGINESDIR: "C:\Program Files (x86)\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files (x86)\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3563103148.000000006C7A4000.00000002.00000001.01000000.00000019.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\pyexpat.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3567006629.000000006F85F000.00000002.00000001.01000000.0000000E.sdmp
    Source: Binary string: lblobi2d_providedcrypto\asn1\i2d_evp.ci2d_PrivateKeycrypto\passphrase.cossl_pw_set_passphraseossl_pw_set_pem_password_cbossl_pw_set_ossl_passphrase_cbossl_pw_set_ui_methoddo_ui_passphrasepass phraseossl_pw_get_passphrasePrompt info data type incorrectNo password method specifiedPVKcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllcrypto\initthread.cOPENSSL_ia32capp? source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3563103148.000000006C7A4000.00000002.00000001.01000000.00000019.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb"" source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698317093.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3552751498.0000000069514000.00000002.00000001.01000000.00000033.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\python3.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3550916655.0000000010000000.00000002.00000001.01000000.00000007.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\audio\qtaudio_windows.pdb(( source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1696877063.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1696823107.0000000000C88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3564030118.000000006CB54000.00000002.00000001.01000000.00000011.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\select.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3567231236.000000006F873000.00000002.00000001.01000000.0000000D.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\bearer\qgenericbearer.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697199492.0000000000C88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\generic\qtuiotouchplugin.pdb"" source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1697443975.0000000000C88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdbU source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3560059190.000000006BF24000.00000002.00000001.01000000.00000020.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_asyncio.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3566609369.000000006F827000.00000002.00000001.01000000.00000013.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_decimal.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3565095672.000000006E3C2000.00000002.00000001.01000000.00000016.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qjpeg.pdbTT source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698495365.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3552434786.0000000069506000.00000002.00000001.01000000.00000034.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\unicodedata.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3563457421.000000006C9CC000.00000002.00000001.01000000.00000017.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtmultimedia\plugins\audio\qtaudio_windows.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1696877063.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1696823107.0000000000C88000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qjpeg.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1698495365.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3552434786.0000000069506000.00000002.00000001.01000000.00000034.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwbmp.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1699312188.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3551301360.00000000693D3000.00000002.00000001.01000000.00000039.sdmp
    Source: Binary string: D:\a\1\b\bin\win32\_socket.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3567447950.000000006F888000.00000002.00000001.01000000.0000000C.sdmp
    Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\libEGL.pdb source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1688256246.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3554291265.0000000069FB3000.00000002.00000001.01000000.0000002E.sdmp
    Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 1.1.1t 7 Feb 2023built on: Thu Feb 9 15:27:35 2023 UTCplatform: VC-WIN32OPENSSLDIR: "C:\Program Files (x86)\Common Files\SSL"ENGINESDIR: "C:\Program Files (x86)\OpenSSL\lib\engines-1_1"not available source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3564030118.000000006CB54000.00000002.00000001.01000000.00000011.sdmp
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 0_2_004014F0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,0_2_004014F0
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exeStatic PE information: section name: /4
    Source: MSVCP140.dll.0.drStatic PE information: section name: .didat
    Source: Qt5Core.dll.0.drStatic PE information: section name: .qtmimed
    Source: opengl32sw.dll.0.drStatic PE information: section name: _RDATA
    Source: qtaudio_wasapi.dll.0.drStatic PE information: section name: .qtmetad
    Source: qtaudio_windows.dll.0.drStatic PE information: section name: .qtmetad
    Source: qgenericbearer.dll.0.drStatic PE information: section name: .qtmetad
    Source: qtuiotouchplugin.dll.0.drStatic PE information: section name: .qtmetad
    Source: qsvgicon.dll.0.drStatic PE information: section name: .qtmetad
    Source: qgif.dll.0.drStatic PE information: section name: .qtmetad
    Source: qicns.dll.0.drStatic PE information: section name: .qtmetad
    Source: qico.dll.0.drStatic PE information: section name: .qtmetad
    Source: qjpeg.dll.0.drStatic PE information: section name: .qtmetad
    Source: qsvg.dll.0.drStatic PE information: section name: .qtmetad
    Source: qtga.dll.0.drStatic PE information: section name: .qtmetad
    Source: qtiff.dll.0.drStatic PE information: section name: .qtmetad
    Source: qwbmp.dll.0.drStatic PE information: section name: .qtmetad
    Source: qwebp.dll.0.drStatic PE information: section name: .qtmetad
    Source: dsengine.dll.0.drStatic PE information: section name: .qtmetad
    Source: qtmedia_audioengine.dll.0.drStatic PE information: section name: .qtmetad
    Source: wmfengine.dll.0.drStatic PE information: section name: .qtmetad
    Source: qminimal.dll.0.drStatic PE information: section name: .qtmetad
    Source: qoffscreen.dll.0.drStatic PE information: section name: .qtmetad
    Source: qwebgl.dll.0.drStatic PE information: section name: .qtmetad
    Source: qwindows.dll.0.drStatic PE information: section name: .qtmetad
    Source: qxdgdesktopportal.dll.0.drStatic PE information: section name: .qtmetad
    Source: qtmultimedia_m3u.dll.0.drStatic PE information: section name: .qtmetad
    Source: windowsprintersupport.dll.0.drStatic PE information: section name: .qtmetad
    Source: qwindowsvistastyle.dll.0.drStatic PE information: section name: .qtmetad
    Source: libcrypto-1_1.dll.0.drStatic PE information: section name: .00cfg
    Source: libsecp256k1-2.dll.0.drStatic PE information: section name: /4
    Source: libssl-1_1.dll.0.drStatic PE information: section name: .00cfg
    Source: libusb-1.0.dll.0.drStatic PE information: section name: /4
    Source: libzbar-0.dll.0.drStatic PE information: section name: /4
    Source: python310.dll.0.drStatic PE information: section name: PyRuntim
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 0_2_0041B970 push ds; ret 0_2_0041B978
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 0_2_0041C3EB push ebx; iretd 0_2_0041C470
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 0_2_0041C467 push ebx; iretd 0_2_0041C470
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 2_2_0041B970 push ds; ret 2_2_0041B978
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 2_2_0041C3EB push ebx; iretd 2_2_0041C470
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 2_2_0041C467 push ebx; iretd 2_2_0041C470
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\_overlapped.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\_ssl.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\MSVCP140_1.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qicns.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\_asyncio.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\platforms\qminimal.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\_queue.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\QtWidgets.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\QtCore.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\_multiprocessing.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\opengl32sw.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\audio\qtaudio_windows.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\libsecp256k1-2.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\_lzma.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\libEGL.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\_bz2.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\QtNetwork.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5Network.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\select.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\QtPrintSupport.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5DBus.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qtga.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\libcrypto-1_1.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\platforms\qoffscreen.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\sqlite3.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\_hashlib.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5WebSockets.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5PrintSupport.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\cryptography\hazmat\bindings\_rust.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\python3.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5Quick.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qgif.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qwbmp.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\libGLESv2.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\bearer\qgenericbearer.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\printsupport\windowsprintersupport.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5QmlModels.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\hid.cp310-win32.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\mediaservice\dsengine.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\python310.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\_sqlite3.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\libzbar-0.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qtiff.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\libusb-1.0.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\QtMultimedia.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\_decimal.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5Widgets.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qwebp.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\platforms\qwebgl.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\VCRUNTIME140.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\QtGui.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qico.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5Qml.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\pyexpat.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5Gui.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qsvg.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5Multimedia.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\audio\qtaudio_wasapi.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\libssl-1_1.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\libffi-7.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5Core.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5Svg.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\_ctypes.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\_cffi_backend.cp310-win32.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\playlistformats\qtmultimedia_m3u.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\MSVCP140.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\d3dcompiler_47.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\platforms\qwindows.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\unicodedata.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\iconengines\qsvgicon.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\_socket.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\mediaservice\wmfengine.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\libeay32.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\mediaservice\qtmedia_audioengine.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qjpeg.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\ssleay32.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\_uuid.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\sip.cp310-win32.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\LICENSE.txtJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\revealer\LICENSE_DEJAVU.txtJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\revealer\SIL Open Font License.txtJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 0_2_00406D50 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00406D50
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeWindow / User API: foregroundWindowGot 745Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\_overlapped.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\_ssl.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qicns.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\_asyncio.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\platforms\qminimal.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\_queue.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\QtWidgets.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\QtCore.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\_multiprocessing.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\audio\qtaudio_windows.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\opengl32sw.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\libsecp256k1-2.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\_lzma.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\_bz2.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\QtNetwork.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\select.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\QtPrintSupport.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5DBus.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qtga.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\platforms\qoffscreen.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\_hashlib.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5WebSockets.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5PrintSupport.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\cryptography\hazmat\bindings\_rust.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\python3.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5Quick.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qgif.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qwbmp.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\printsupport\windowsprintersupport.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\bearer\qgenericbearer.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5QmlModels.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\hid.cp310-win32.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\python310.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\mediaservice\dsengine.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\_sqlite3.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\libzbar-0.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qtiff.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\libusb-1.0.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\QtMultimedia.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\_decimal.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\platforms\qwebgl.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qwebp.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\QtGui.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qico.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5Qml.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\pyexpat.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qsvg.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\audio\qtaudio_wasapi.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\_ctypes.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\_cffi_backend.cp310-win32.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\playlistformats\qtmultimedia_m3u.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\unicodedata.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\platforms\qwindows.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\d3dcompiler_47.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\_socket.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\iconengines\qsvgicon.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\mediaservice\wmfengine.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\libeay32.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\mediaservice\qtmedia_audioengine.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qjpeg.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\_uuid.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\ssleay32.dllJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\sip.cp310-win32.pydJump to dropped file
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_0-19748
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeAPI coverage: 8.6 %
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeAPI coverage: 0.9 %
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 0_2_00408F20 FindFirstFileExW,FindClose,0_2_00408F20
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 2_2_00408F20 FindFirstFileExW,FindClose,2_2_00408F20
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\audio\Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\bearer\Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Jump to behavior
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1742016137.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1741918397.0000000000C89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: # Maybe look for Jade Qemu simulator if the vars are set (experimental)
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1742016137.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1741918397.0000000000C89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: # For testing with qemu simulator (experimental)
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1742016137.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1741918397.0000000000C89000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: id_='Jade Qemu Simulator',
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1878200365.000000000094F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1878870281.0000000000947000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1880966250.0000000000947000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1874041495.0000000000949000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllB
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3549525302.0000000005758000.00000008.00000001.01000000.00000025.sdmpBinary or memory string: .?AVQEmulationPaintEngine@@
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 2_2_050DBD1B IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_050DBD1B
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 0_2_004014F0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,0_2_004014F0
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 0_2_0040117C Sleep,Sleep,SetUnhandledExceptionFilter,__p__wcmdln,malloc,malloc,memcpy,__winitenv,_amsg_exit,_initterm,GetStartupInfoW,_cexit,_initterm,exit,0_2_0040117C
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 0_2_00401170 Sleep,SetUnhandledExceptionFilter,__p__wcmdln,malloc,malloc,memcpy,__winitenv,0_2_00401170
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 0_2_004011B3 Sleep,SetUnhandledExceptionFilter,__p__wcmdln,malloc,malloc,memcpy,__winitenv,0_2_004011B3
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 2_2_0040117C Sleep,Sleep,SetUnhandledExceptionFilter,__p__wcmdln,malloc,malloc,memcpy,__winitenv,_amsg_exit,_initterm,GetStartupInfoW,_cexit,_initterm,exit,2_2_0040117C
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 2_2_00401170 Sleep,SetUnhandledExceptionFilter,__p__wcmdln,malloc,malloc,memcpy,__winitenv,2_2_00401170
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 2_2_004011B3 Sleep,SetUnhandledExceptionFilter,__p__wcmdln,malloc,malloc,memcpy,__winitenv,2_2_004011B3
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 2_2_050DBD1B IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_050DBD1B
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c fsutil sparse setflag "C:\Users\user\Desktop\electrum_data\blockchain_headers" 1Jump to behavior
    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\fsutil.exe fsutil sparse setflag "C:\Users\user\Desktop\electrum_data\blockchain_headers" 1Jump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\_ctypes.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\_bz2.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\_lzma.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\_socket.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\select.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\pyexpat.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\_queue.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\_ssl.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\_asyncio.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\_overlapped.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\_hashlib.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\certifi\cacert.pem VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\_decimal.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\unicodedata.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762\_uuid.pyd VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI68762 VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeQueries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe VolumeInformationJump to behavior
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

    Stealing of Sensitive Information

    barindex
    Found many strings related to Crypto-Wallets (likely being stolen)
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exeString found in binary or memory: tagged by Electrum@99f6dd5d5d63bdb311bd401835cb20423728f889
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1840754626.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: "btc.electroncash.dk": {
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1746345465.0000000000C86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: def get_singlesig_default_wallet_policy(self, addr_type: 'AddressType', account: int) -> 'WalletPolicy':
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3541413248.0000000002E20000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: safetlib.messages.EthereumTxAck
    Source: SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1831918607.0000000000C87000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: registers_keystore = ('hardware', 'safe_t', _("Safe-T mini wallet"))
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 2_2_05084F50 ?bindAttributeLocation@QOpenGLShaderProgram@@QAEXABVQByteArray@@H@Z,?bindAttributeLocation@QOpenGLShaderProgram@@QAEXABVQString@@H@Z,_Py_NoneStruct,_Py_NoneStruct,2_2_05084F50
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 2_2_0509AF70 ?bind@QOpenGLBuffer@@QAE_NXZ,PyBool_FromLong,2_2_0509AF70
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 2_2_05096870 ?bind@QOpenGLVertexArrayObject@@QAEXXZ,_Py_NoneStruct,_Py_NoneStruct,2_2_05096870
    Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exeCode function: 2_2_050848E0 ?bind@QOpenGLShaderProgram@@QAE_NXZ,PyBool_FromLong,2_2_050848E0

    Mitre Att&ck Matrix

    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
    Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
    Native API    		1
    DLL Side-Loading    		11
    Process Injection    		1
    Masquerading    		OS Credential Dumping11
    Security Software Discovery    		Remote Services11
    Archive Collected Data    		1
    Encrypted Channel    		Exfiltration Over Other Network MediumAbuse Accessibility Features
    CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
    DLL Side-Loading    		11
    Process Injection    		LSASS Memory1
    Application Window Discovery    		Remote Desktop Protocol1
    Data from Local System    		Junk DataExfiltration Over BluetoothNetwork Denial of Service
    Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
    Deobfuscate/Decode Files or Information    		Security Account Manager2
    File and Directory Discovery    		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
    Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook2
    Obfuscated Files or Information    		NTDS12
    System Information Discovery    		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
    Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
    Software Packing    		LSA SecretsInternet Connection DiscoverySSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
    Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
    DLL Side-Loading    		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet
    behaviorgraph top1 signatures2 2 Behavior Graph ID: 1409007 Sample: SecuriteInfo.com.Win32.Patc... Startdate: 14/03/2024 Architecture: WINDOWS Score: 52 40 Yara detected Generic Python Ransomware 2->40 42 Found many strings related to Crypto-Wallets (likely being stolen) 2->42 8 SecuriteInfo.com.Win32.Patched.29806.7109.exe 1001 2->8         started        process3 file4 30 C:\Users\user\AppData\...\unicodedata.pyd, PE32 8->30 dropped 32 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 8->32 dropped 34 C:\Users\user\AppData\Local\...\select.pyd, PE32 8->34 dropped 36 163 other files (none is malicious) 8->36 dropped 44 Found many strings related to Crypto-Wallets (likely being stolen) 8->44 12 SecuriteInfo.com.Win32.Patched.29806.7109.exe 7 8->12         started        signatures5 process6 dnsIp7 38 127.0.0.1 unknown unknown 12->38 46 Found many strings related to Crypto-Wallets (likely being stolen) 12->46 16 cmd.exe 1 12->16         started        18 cmd.exe 1 12->18         started        20 cmd.exe 12->20         started        signatures8 process9 process10 22 conhost.exe 16->22         started        24 fsutil.exe 1 16->24         started        26 conhost.exe 18->26         started        28 conhost.exe 20->28         started       

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    SecuriteInfo.com.Win32.Patched.29806.7109.exe3%ReversingLabs

    Dropped Files

    SourceDetectionScannerLabelLink
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\MSVCP140.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\MSVCP140_1.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5Core.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5DBus.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5Gui.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5Multimedia.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5Network.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5PrintSupport.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5Qml.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5QmlModels.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5Quick.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5Svg.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5WebSockets.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5Widgets.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\d3dcompiler_47.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\libEGL.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\libGLESv2.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\libeay32.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\opengl32sw.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\ssleay32.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\audio\qtaudio_wasapi.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\audio\qtaudio_windows.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\bearer\qgenericbearer.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\iconengines\qsvgicon.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qgif.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qicns.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qico.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qjpeg.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qsvg.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qtga.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qtiff.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qwbmp.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qwebp.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\mediaservice\dsengine.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\mediaservice\qtmedia_audioengine.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\mediaservice\wmfengine.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\platforms\qminimal.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\platforms\qoffscreen.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\platforms\qwebgl.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\platforms\qwindows.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\playlistformats\qtmultimedia_m3u.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\printsupport\windowsprintersupport.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\QtCore.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\QtGui.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\QtMultimedia.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\QtNetwork.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\QtPrintSupport.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\QtWidgets.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\sip.cp310-win32.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\VCRUNTIME140.dll0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\_asyncio.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\_bz2.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\_cffi_backend.cp310-win32.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\_ctypes.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\_decimal.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\_hashlib.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\_lzma.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\_multiprocessing.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\_overlapped.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\_queue.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\_socket.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\_sqlite3.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\_ssl.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\_uuid.pyd0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\bitbox02\communication\generated\backup_commands_pb2.pyi0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\bitbox02\communication\generated\bitbox02_system_pb2.pyi0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\bitbox02\communication\generated\btc_pb2.pyi0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\bitbox02\communication\generated\common_pb2.pyi0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\bitbox02\communication\generated\eth_pb2.pyi0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\bitbox02\communication\generated\hww_pb2.pyi0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\bitbox02\communication\generated\keystore_pb2.pyi0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\bitbox02\communication\generated\mnemonic_pb2.pyi0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\bitbox02\communication\generated\perform_attestation_pb2.pyi0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\bitbox02\communication\generated\system_pb2.pyi0%ReversingLabs
    C:\Users\user\AppData\Local\Temp\_MEI68762\cryptography\hazmat\bindings\_rust.pyd0%ReversingLabs

    Unpacked PE Files

    ⊘No Antivirus matches

    Domains

    ⊘No Antivirus matches

    URLs

    SourceDetectionScannerLabelLink
    http://www.cl.cam.ac.uk/~mgk25/iso-time.html0%URL Reputationsafe
    http://jacek.jedrzejewski.name)0%Avira URL Cloudsafe
    http://en.wikipede0%Avira URL Cloudsafe
    https://testnet.smartbit.com.au/0%Avira URL Cloudsafe
    https://api.trustedcoin.com/2/0%Avira URL Cloudsafe
    http://xmr.link0%Avira URL Cloudsafe
    http://www.fontbureau.comhttp://www.fontbureau.com/designersNormalNormaaliNormalNorm0%Avira URL Cloudsafe
    http://www.jiyu-kobo.co.jp/Microsoft0%Avira URL Cloudsafe
    https://mempool.space/testnet/0%Avira URL Cloudsafe
    https://oxt.me/0%Avira URL Cloudsafe
    https://mempool.emzy.de/0%Avira URL Cloudsafe
    https://mahler:8092/site-updates.py0%Avira URL Cloudsafe
    https://mempool.space/signet/0%Avira URL Cloudsafe
    https://mempool.space/0%Avira URL Cloudsafe
    https://blockstream.info/0%Avira URL Cloudsafe
    http://.../back.jpeg0%Avira URL Cloudsafe

    Domains and IPs

    Contacted Domains

    ⊘No contacted domains info

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    https://docs.python.org/3/library/ssl.html#ssl.OP_NO_COMPRESSIONSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1891579280.000000000330E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3543243136.0000000003A10000.00000004.00001000.00020000.00000000.sdmpfalse
      		high
      https://EditorConfig.orgSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1746876620.0000000000C87000.00000004.00000020.00020000.00000000.sdmpfalse
        		high
        https://github.com/pyca/cryptography/issues/8996SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3563103148.000000006C7A4000.00000002.00000001.01000000.00000019.sdmpfalse
          		high
          http://bugs.python.org/issue1230540SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3542697776.00000000036E0000.00000004.00001000.00020000.00000000.sdmpfalse
            		high
            https://github.com/keepkey/python-keepkeySecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1744748979.0000000000C89000.00000004.00000020.00020000.00000000.sdmpfalse
              		high
              https://testnet.smartbit.com.au/SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://www.python.org/dev/peps/pep-0506/SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3542787700.0000000003770000.00000004.00001000.00020000.00000000.sdmpfalse
                		high
                http://jqueryui.comSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1821392119.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1749721154.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1769676147.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1767561669.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1782407679.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1796126447.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1799437386.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1780063226.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1775184828.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1821152843.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1765432851.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1773045537.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1751192021.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1749986367.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1750185245.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1769494179.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1767754138.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1805050969.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1795911835.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1763692486.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1792408282.0000000000C86000.00000004.00000020.00020000.00000000.sdmpfalse
                  		high
                  http://api.jqueryui.com/category/theming/SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1821392119.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1769676147.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1796126447.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1799437386.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1780063226.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1773045537.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1749986367.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1767754138.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1805050969.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1763692486.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1792408282.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1796103622.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1786718277.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1804999359.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1751347454.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1814590663.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1773065571.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1753795626.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1751363749.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1758186181.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1761141855.0000000000C86000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    https://github.com/aio-libs/aiohttp/discussions/6044SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1896214508.0000000003222000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3542882830.00000000037F0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1891579280.000000000330E000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high
                      https://github.com/romis2012/aiohttp-socks/issues/27SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3543147586.0000000003980000.00000004.00001000.00020000.00000000.sdmpfalse
                        		high
                        http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CArial%2Csans-serif&fwDefault=bold&fsDefault=SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1802104747.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1802329035.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1810270232.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1810048169.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1802129205.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1802352514.0000000000C87000.00000004.00000020.00020000.00000000.sdmpfalse
                          		high
                          https://python.org/dev/peps/pep-0263/SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3564515928.000000006CF34000.00000002.00000001.01000000.00000005.sdmpfalse
                            		high
                            http://jqueryui.com/themeroller/?ffDefault=Arial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1755343234.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1755614063.0000000000C86000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3540967311.0000000000879000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1863040306.0000000000914000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1862588931.0000000000914000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1863349120.0000000000914000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                https://tools.ietf.org/html/rfc2388#section-4.4SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1894277891.000000000331D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1891003827.000000000335C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1895376844.000000000331D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1892334211.000000000335C000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  https://github.com/Blockstream/Jade)SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1742907613.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1742888863.0000000000C87000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1799437386.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1792408282.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1753795626.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1760813864.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1761141855.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1799413081.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1753773406.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1799174464.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1799150347.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1753588012.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1792127183.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1753564833.0000000000C86000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      https://github.com/pypa/packagingSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3542213988.00000000033E0000.00000004.00001000.00020000.00000000.sdmpfalse
                                        		high
                                        https://github.com/satoshilabs/slips/blob/master/slip-0039.md.SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3546846006.00000000046F0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1919458192.0000000003E9C000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          http://www.opensource.org/licenses/mit-license.phpSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1830890449.0000000000C86000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://refspecs.linuxfoundation.org/elf/gabi4SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3542165002.00000000033A0000.00000004.00001000.00020000.00000000.sdmpfalse
                                              		high
                                              http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CHelvetica%2CArial%2Csans-serif&fwDefault=bolSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1780063226.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1779714584.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1807548191.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1807754519.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1779658379.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1780114222.0000000000C87000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                https://github.com/scott-griffiths/bitstringSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1896214508.0000000003222000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://www.fontbureau.comhttp://www.fontbureau.com/designersNormalNormaaliNormalNormSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3543851792.0000000003DB0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  http://www.jiyu-kobo.co.jp/MicrosoftSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3543851792.0000000003FD3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3540967311.0000000000879000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  https://github.com/python-attrs/attrs/issues/136SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1894277891.000000000331D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1891579280.000000000331D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1895376844.000000000331D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://jqueryui.com/themeroller/?ffDefault=Arial%2Csans-serif&fwDefault=bold&fsDefault=1.3em&cornerRSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1763692486.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1763451882.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1763673008.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1763431788.0000000000C86000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://curl.haxx.se/rfc/cookie_spec.htmlSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3541627817.0000000002FF0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1896214508.0000000003222000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://oxt.me/SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        http://docs.python.org/3/library/subprocess#subprocess.Popen.returncodeSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3542607867.0000000003640000.00000004.00001000.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://github.com/spesmilo/electrumSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3545225242.00000000041B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                            		high
                                                            http://en.wikipedeSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3543851792.0000000003FD3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            		unknown
                                                            http://jqueryui.com/themeroller/?ffDefault=segoe%20ui%2CArial%2Csans-serif&fwDefault=bold&fsDefault=SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1767561669.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1796126447.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1767754138.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1795911835.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1796103622.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1767537923.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1767775056.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1795890367.0000000000C86000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://github.com/romis2012/python-socksSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3543243136.0000000003A10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://zopeinterface.readthedocs.io/en/latest/SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1896214508.0000000003222000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://httpbin.org/getSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3543102136.0000000003940000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    http://httpbin.org/SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1894277891.0000000003375000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3540967311.0000000000879000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1892334211.0000000003378000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1891003827.0000000003378000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://github.com/spesmilo/electrum/issues/6971)).SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1841824249.0000000000C86000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://docs.electrum.org/rSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1921471224.0000000003E9C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-accessSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1873488031.0000000002EE2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884412932.0000000002EDA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1868464266.0000000002E9B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1872260409.0000000002EE2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1870663174.0000000002EE2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1874125303.0000000002EE2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1875641378.0000000002EE2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1871186479.0000000002EE2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1880226656.0000000002EDB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1876688827.0000000002EE2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1869198809.0000000002EE2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://api.trustedcoin.com/2/SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1840141986.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3550361040.0000000005A60000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            http://jacek.jedrzejewski.name)SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1748197226.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1748213876.0000000000C87000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		low
                                                                            https://btc.com/SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readerSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3540967311.0000000000879000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1863040306.0000000000914000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1862588931.0000000000914000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1863349120.0000000000914000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://mempool.space/testnet/SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                • Avira URL Cloud: safe
                                                                                		unknown
                                                                                https://httpbin.org/SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1894277891.0000000003375000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3540967311.0000000000879000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1892334211.0000000003378000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1891003827.0000000003378000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://xmr.linkSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1893873907.0000000003DD1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  • Avira URL Cloud: safe
                                                                                  		unknown
                                                                                  https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-fileSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3563103148.000000006C7A4000.00000002.00000001.01000000.00000019.sdmpfalse
                                                                                    		high
                                                                                    http://www.cl.cam.ac.uk/~mgk25/iso-time.htmlSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1870663174.0000000002EE2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1871139889.0000000002EE6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    • URL Reputation: safe
                                                                                    		unknown
                                                                                    https://github.com/keis/base58SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3543802712.0000000003D70000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      http://www.iana.org/SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1896214508.0000000003222000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        http://www.symauth.com/cps0(SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1822550374.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1822600547.0000000000C86000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://jqueryui.com/themeroller/?ffDefault=Arial%2CHelvetica%2Csans-serif&fsDefault=1em&fwDefault=noSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1751192021.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1751347454.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1751363749.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1751174399.0000000000C86000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1894277891.0000000003375000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1892334211.0000000003378000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1891003827.0000000003378000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sySecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3540967311.0000000000879000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1863040306.0000000000914000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1862588931.0000000000914000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1863349120.0000000000914000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://docs.python.org/3/library/re.htmlSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1880110113.0000000003202000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1896214508.0000000003222000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3542213988.00000000033E0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1881565761.000000000322D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://jquery.org/SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1748343252.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1748326006.0000000000C87000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    http://github.com/ActiveState/appdirsSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3542213988.00000000033E0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://live.blockcypher.com/btc/SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://mempool.emzy.de/SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        • Avira URL Cloud: safe
                                                                                                        		unknown
                                                                                                        https://wiki.debian.org/XDGBaseDirectorySpecification#stateSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884412932.0000000002EDA000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1880226656.0000000002EDB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          http://wwwsearch.sf.net/):SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1894277891.0000000003375000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1896214508.0000000003222000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1892334211.0000000003378000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            http://tools.ietf.org/html/rfc6125#section-6.4.3SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3541718331.0000000003090000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              https://btc.bitaps.com/rSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://cffi.readthedocs.io/en/latest/using.html#callbacksSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3562441441.000000006C3BA000.00000002.00000001.01000000.0000001A.sdmpfalse
                                                                                                                  		high
                                                                                                                  http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=normal&fsDefaultSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1821392119.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1775184828.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1821152843.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1775371549.0000000000C86000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://wallet.trezor.ioSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1838400649.0000000000C89000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://github.com/trezor/trezor-mcu/pull/306SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1838485058.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1836872184.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1836788366.0000000000C89000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://bugs.python.org/issue37179SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1896214508.0000000003222000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3542882830.00000000037F0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1891579280.000000000330E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://blockchain.com/btc/SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://blockchair.com/bitcoin/SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              http://stackoverflow.com/questiSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1821823243.0000000000C86000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                https://mempool.space/SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                • Avira URL Cloud: safe
                                                                                                                                		unknown
                                                                                                                                http://www.symauth.com/rpa04SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1822550374.0000000000C88000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1822600547.0000000000C86000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.pySecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1863349120.0000000000914000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    http://www.phys.uu.nl/~vgent/calendar/isocalendar.htmSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1870663174.0000000002EE2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1871139889.0000000002EE6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      http://dejavu.sourceforge.net/wiki/index.php/LicenseSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1822030201.0000000000C88000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        http://stackoverflow.com/questions/18729405/how-to-convert-utf8-string-to-byte-arraySecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1821823243.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1821879495.0000000000C8F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://github.com/pyca/cryptography/issuesSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3545225242.00000000041B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            https://www.keepkey.comSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1744748979.0000000000C89000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1894277891.000000000331D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1891003827.000000000335C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1895376844.000000000331D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1892334211.000000000335C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                https://www.attrs.org/SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3543102136.0000000003940000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  http://google.com/SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1891003827.0000000003378000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    https://chainflyer.bitflyer.jp/SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      https://mahler:8092/site-updates.pySecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1896214508.0000000003222000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      • Avira URL Cloud: safe
                                                                                                                                                      		low
                                                                                                                                                      https://blockstream.info/SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      • Avira URL Cloud: safe
                                                                                                                                                      		unknown
                                                                                                                                                      https://github.com/Blockstream/Jade/releases/tag/0.1.37).SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1742907613.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1742888863.0000000000C87000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        https://mempool.space/signet/SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        • Avira URL Cloud: safe
                                                                                                                                                        		unknown
                                                                                                                                                        https://urllib3.readthedocs.io/en/stable/v2-migration-guide.htmlSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3541627817.0000000002FF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          https://github.com/trezor/trezor-common/blob/44dfb07cfaafffada4b2ce0d15ba1d90d17cf35e/protob/types.pSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1836184924.0000000000C86000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            https://insight.bitpay.com/SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1884060012.0000000003305000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              http://jquery.org/licenseSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1821392119.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1769676147.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1796126447.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1799437386.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1780063226.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1773045537.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1749986367.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1767754138.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1805050969.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1763692486.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1792408282.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1796103622.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1786718277.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1804999359.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1751347454.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1814590663.0000000000C86000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1773065571.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1753795626.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1751363749.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1758186181.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1761141855.0000000000C86000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                https://digitalbitbox.com/smartverification/index.phpSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1740588098.0000000000C89000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1740623655.0000000000C86000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  http://.../back.jpegSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3543678133.0000000003CF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                  • Avira URL Cloud: safe
                                                                                                                                                                  		low
                                                                                                                                                                  http://www.openssl.org/VSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1696316170.0000000000C88000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    https://www.python.org/download/releases/2.3/mro/.SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1859499963.00000000008F6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1859740884.000000000090C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1859629428.0000000000909000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      https://github.comSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000002.3543147586.0000000003980000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#https-proxy-error-http-proxySecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1890390070.000000000338A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000002.00000003.1890033485.0000000003378000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          https://github.com/jquery/jquery-uiSecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1748343252.0000000000C87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.Patched.29806.7109.exe, 00000000.00000003.1748326006.0000000000C87000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high

                                                                                                                                                                            World Map of Contacted IPs

                                                                                                                                                                            • No. of IPs < 25%
                                                                                                                                                                            • 25% < No. of IPs < 50%
                                                                                                                                                                            • 50% < No. of IPs < 75%
                                                                                                                                                                            • 75% < No. of IPs

                                                                                                                                                                            Public IPs

                                                                                                                                                                            IPDomainCountryFlagASNASN NameMalicious

                                                                                                                                                                            Private

                                                                                                                                                                            IP
                                                                                                                                                                            127.0.0.1

                                                                                                                                                                            General Information

                                                                                                                                                                            Joe Sandbox version:40.0.0 Tourmaline
                                                                                                                                                                            Analysis ID:1409007
                                                                                                                                                                            Start date and time:2024-03-14 15:37:51 +01:00
                                                                                                                                                                            Joe Sandbox product:CloudBasic
                                                                                                                                                                            Overall analysis duration:0h 11m 11s
                                                                                                                                                                            Hypervisor based Inspection enabled:false
                                                                                                                                                                            Report type:full
                                                                                                                                                                            Cookbook file name:default.jbs
                                                                                                                                                                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                            Run name:Run with higher sleep bypass
                                                                                                                                                                            Number of analysed new started processes analysed:15
                                                                                                                                                                            Number of new started drivers analysed:0
                                                                                                                                                                            Number of existing processes analysed:0
                                                                                                                                                                            Number of existing drivers analysed:0
                                                                                                                                                                            Number of injected processes analysed:0
                                                                                                                                                                            Technologies:
                                                                                                                                                                            • HCA enabled
                                                                                                                                                                            • EGA enabled
                                                                                                                                                                            • AMSI enabled
                                                                                                                                                                            Analysis Mode:default
                                                                                                                                                                            Analysis stop reason:Timeout
                                                                                                                                                                            Sample name:SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                            Detection:MAL
                                                                                                                                                                            Classification:mal52.rans.spyw.winEXE@14/875@0/1
                                                                                                                                                                            EGA Information:
                                                                                                                                                                            • Successful, ratio: 100%
                                                                                                                                                                            HCA Information:
                                                                                                                                                                            • Successful, ratio: 98%
                                                                                                                                                                            • Number of executed functions: 47
                                                                                                                                                                            • Number of non-executed functions: 487
                                                                                                                                                                            Cookbook Comments:
                                                                                                                                                                            • Found application associated with file extension: .exe
                                                                                                                                                                            • Sleeps bigger than 100000000ms are automatically reduced to 1000ms

                                                                                                                                                                            Warnings

                                                                                                                                                                            • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                                                                                                                                                            • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                            • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                            • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                            • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                            • Report size getting too big, too many NtCreateFile calls found.
                                                                                                                                                                            • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                                                                            • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                            • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                                                                            • VT rate limit hit for: SecuriteInfo.com.Win32.Patched.29806.7109.exe

                                                                                                                                                                            Simulations

                                                                                                                                                                            Behavior and APIs

                                                                                                                                                                            ⊘No simulations

                                                                                                                                                                            Joe Sandbox View / Context

                                                                                                                                                                            IPs

                                                                                                                                                                            ⊘No context

                                                                                                                                                                            Domains

                                                                                                                                                                            ⊘No context

                                                                                                                                                                            ASNs

                                                                                                                                                                            ⊘No context

                                                                                                                                                                            JA3 Fingerprints

                                                                                                                                                                            ⊘No context

                                                                                                                                                                            Dropped Files

                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5Core.dllelectrum-4.5.3-setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                              electrum-4.5.3.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                PPN Service Tool V2.10.00_20220923.msiGet hashmaliciousUnknownBrowse
                                                                                                                                                                                  PPN Service Tool V2.10.00_20220923.msiGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    z4GObISliI.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                      z4GObISliI.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                        BEwkwcQFOA.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                          CABPRansom.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\MSVCP140.dllelectrum-4.5.3-setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                              electrum-4.5.3.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                BEwkwcQFOA.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                  https://files.jalinga.com/builds/releases/jalinga_studio.4.0.2040.0.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    MedMooc.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      FileZilla_3.52.2_win64_sponsored-setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        f_026dfd.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\MSVCP140_1.dllelectrum-4.5.3-setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            electrum-4.5.3.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                              BEwkwcQFOA.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                https://files.jalinga.com/builds/releases/jalinga_studio.4.0.2040.0.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                  CABPRansom.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    MedMooc.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                                      Created / dropped Files

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\MSVCP140.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):454128
                                                                                                                                                                                                                      Entropy (8bit):6.669498628019609
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12288:y9vcHNFaPZ2Jj/gMvpbUUtQgTCZuGre6gIo1hUgiW6QR7t5s03Ooc8dHkC2esrVx:ytcHNa2Jj/g4bUUtQgTn6g003Ooc8dHE
                                                                                                                                                                                                                      MD5:ECEFF9C92E14B580EA84365F3D60F7DE
                                                                                                                                                                                                                      SHA1:00699126456379FA48CB122E21B7F4731A72C57C
                                                                                                                                                                                                                      SHA-256:265591A709A5DB413D73C95B538DA321EDEACB40059BDCEB142F997A3D458B49
                                                                                                                                                                                                                      SHA-512:FD325D77EB2C30E1CD1B2D871986E057318C1BE911793521C7BF79FB2C5DC359CB7DB90C6D6C5711FEDD734B6B03117B8BAF241DFBD78585CF55A25983EC8727
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Joe Sandbox View:
                                                                                                                                                                                                                      • Filename: electrum-4.5.3-setup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                      • Filename: electrum-4.5.3.exe, Detection: malicious, Browse
                                                                                                                                                                                                                      • Filename: BEwkwcQFOA.exe, Detection: malicious, Browse
                                                                                                                                                                                                                      • Filename: , Detection: malicious, Browse
                                                                                                                                                                                                                      • Filename: MedMooc.exe, Detection: malicious, Browse
                                                                                                                                                                                                                      • Filename: FileZilla_3.52.2_win64_sponsored-setup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                      • Filename: f_026dfd.exe, Detection: malicious, Browse
                                                                                                                                                                                                                      Reputation:moderate, very likely benign file
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........mw`...3...3...3C..3...3.t.3...3...36..3<c.2...3<c.2...3<c.2...3<c.2g..3<c.2...3<c.3...3<c.2...3Rich...3........PE..L.....t^.........."!.....:...................P......................................_Y....@A.........................z...................................A.......;...z..8...........................Xy..@....................v..@....................text....9.......:.................. ..`.data...t(...P.......>..............@....idata...............V..............@..@.didat..4............j..............@....rsrc................l..............@..@.reloc...;.......<...p..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\MSVCP140_1.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):29168
                                                                                                                                                                                                                      Entropy (8bit):6.891197126129158
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:ipMyA7o+HvwTgljud5u+NWc95gWWzc+pBj0HRN7LxlT3cyHRN7/Ujp9fl980:IU0AJsd5uceWncFv
                                                                                                                                                                                                                      MD5:7F71F19F30BE3942EE0EFDDC145D459E
                                                                                                                                                                                                                      SHA1:863048CF8A9692BF43317326C5AA918389546282
                                                                                                                                                                                                                      SHA-256:B8CAFC52B903ED0824882365B0A0D438460260B4DDF2487849EB3BD2241F7E8D
                                                                                                                                                                                                                      SHA-512:4FDFBC7524445EB443E189F64D9732C5C28ACE689C9556B67C8F3647BA7F18B02521DEEAE4FB8138F5F550EE34EFDB2AB2B6FFEA3A43D184A26BDFCE700B2DD5
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Joe Sandbox View:
                                                                                                                                                                                                                      • Filename: electrum-4.5.3-setup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                      • Filename: electrum-4.5.3.exe, Detection: malicious, Browse
                                                                                                                                                                                                                      • Filename: BEwkwcQFOA.exe, Detection: malicious, Browse
                                                                                                                                                                                                                      • Filename: , Detection: malicious, Browse
                                                                                                                                                                                                                      • Filename: CABPRansom.exe, Detection: malicious, Browse
                                                                                                                                                                                                                      • Filename: MedMooc.exe, Detection: malicious, Browse
                                                                                                                                                                                                                      Reputation:moderate, very likely benign file
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................'G......~....X......X............X......X......X......X......X......Rich....................PE..L.....t^.........."!.........................0...............................p......W.....@A.........................*..J....@..x....P...............0...A...`......h...8...............................@............@...............................text............................... ..`.data...H....0....... ..............@....idata.......@......."..............@..@.rsrc........P.......(..............@..@.reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5Core.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5381616
                                                                                                                                                                                                                      Entropy (8bit):6.852156967958758
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:49152:q1AH+7g4QrRpvOK8Bbl+Gy+/LZsxRFNHlZTlJsv6tWKFdu9C/cPk4VHEYI9CV4eO:E5gje5lCjzJsv6tWKFdu9CtvDhgwcY
                                                                                                                                                                                                                      MD5:7D180286E9C071C7BC3A6BC2ACE792AC
                                                                                                                                                                                                                      SHA1:F5947D69AEAACC8A378721F3750B049CC41DDDEF
                                                                                                                                                                                                                      SHA-256:4F8DC460162407CFCCB1BE6EF9CCE45C4449DE838AEFFA3FD33378F01A3F9CC4
                                                                                                                                                                                                                      SHA-512:9B30D5DD48E736DA770E71622B79DA294829621565CFC4D995CA31C8CFBBBE2D577677F4240E0FF2D995DEEEB5F894018412596C141E8360DD77BF12596CE167
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Joe Sandbox View:
                                                                                                                                                                                                                      • Filename: electrum-4.5.3-setup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                      • Filename: electrum-4.5.3.exe, Detection: malicious, Browse
                                                                                                                                                                                                                      • Filename: PPN Service Tool V2.10.00_20220923.msi, Detection: malicious, Browse
                                                                                                                                                                                                                      • Filename: PPN Service Tool V2.10.00_20220923.msi, Detection: malicious, Browse
                                                                                                                                                                                                                      • Filename: z4GObISliI.exe, Detection: malicious, Browse
                                                                                                                                                                                                                      • Filename: z4GObISliI.exe, Detection: malicious, Browse
                                                                                                                                                                                                                      • Filename: BEwkwcQFOA.exe, Detection: malicious, Browse
                                                                                                                                                                                                                      • Filename: CABPRansom.exe, Detection: malicious, Browse
                                                                                                                                                                                                                      Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........S.G.2k..2k..2k..J...2k.p]j..2k.%....2k.p]n..2k.p]o..2k.p]h..2k..Yo..2k..Ym..2k..Yj..2k..2j..3k.=Bo..2k.=Bn.D2k.=Bk..2k.=B...2k..2...2k.=Bi..2k.Rich.2k.........................PE..L...&._...........!......(...).....>x&.......(....g.........................pR.......R...@.........................P D.P....=K.......P...............R.......P..|.. .A.T...................0.A.....x.A.@.............(..............................text...W.(.......(................. ..`.rdata..n."...(..."...(.............@..@.data........`K..J...FK.............@....qtmimed......K.......K.............@..P.rsrc.........P......~P.............@..@.reloc...|....P..~....P.............@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5DBus.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):345072
                                                                                                                                                                                                                      Entropy (8bit):6.69347328565263
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6144:p7/XsDKD1OjnMFTZNgWoVEC8FMVU+SBF5h10xwSfdGX+Asf5YVJ:p7/XsDKROjQN5oVEvcU+SBvh1C5UJ
                                                                                                                                                                                                                      MD5:431E75DD83B3B2FF1954300CC7F43060
                                                                                                                                                                                                                      SHA1:44857528CEEA89420FFCCA97558A655B0B10849C
                                                                                                                                                                                                                      SHA-256:B9BCA43F52D5BFBF014D1C2643516B54EEBB5B07D1DFCA8F4C266628EF9D121A
                                                                                                                                                                                                                      SHA-512:D299B08393C5DD2064CF53CA52F2754EF16D075BF3C549A3EE212908F7537287C0ABE464EA54528B370B554993981DC2BA7C47CA300D6AA8CEB21BC847069B84
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................V.............3......3......3.......3.......~...........+...~......~.......~.:.......R.....~.......Rich............................PE..L...H._...........!................%........................................`......f2....@..........................$..0l...........................(...........H..D...T...................P...........@...............P............................text............................... ..`.rdata..H>.......@..................@..@.data...$...........................@....rsrc...............................@..@.reloc...H.......J..................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5Gui.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5894128
                                                                                                                                                                                                                      Entropy (8bit):6.78187184482046
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:49152:FKUDGaBVW3sDAPNaiCZPcSnt8KQ6oOtA/tiG7WwjrAxLXwQ98vd+hc0WM66fL5cQ:wUKssPdOy/tZWnXThVc5tnB6NDrd
                                                                                                                                                                                                                      MD5:5B0F3D5B1B29B5E650375093C7AFA243
                                                                                                                                                                                                                      SHA1:1920CBC98BD46A3A72BCFB45CAEFCFA2649A92E6
                                                                                                                                                                                                                      SHA-256:80016776EFEA2B2A838C3FFA4C82E5F146BAFF68C36073C0C34668809D1C4297
                                                                                                                                                                                                                      SHA-512:9DB9A90AB5A1A768E079CF9B10F1DA868AC7DAE774E90E139EE047C9C8FB43CC5B3E01AE3724EA74EFD64409EEEAFBCDA4F04DA3E86265575A3831A4FC69CC8C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......hd.d,.q7,.q7,.q7%}.7:.q7.ju6&.q7.jr6 .q7.jt65.q7.jp6(.q7.up6..q78nt6-.q78np6!.q7,.p7G.q7.uu6<.q7.ut6E.q7.uq6-.q7.u.7-.q7,..7-.q7.us6-.q7Rich,.q7........................PE..L....._...........!.....V6...#......L6......p6..............................pZ.....;.Z...@..........................%=.0"...GV.h....0X...............Y......@X.l!....<.T.....................<.......<.@............p6.|............................text...zT6......V6................. ..`.rdata.... ..p6... ..Z6.............@..@.data...,....@W...... W.............@....rsrc........0X.......W.............@..@.reloc..l!...@X.."....W.............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5Multimedia.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):593392
                                                                                                                                                                                                                      Entropy (8bit):6.548929192441609
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6144:UbF/85xSKprGjwf+DC9rSBke4ki3MHun9ygXa4KPno+/+lt6h3kocBln3ShKjJm4:fcwI5kaUKvouh0FBF3SoJS72Jsy
                                                                                                                                                                                                                      MD5:091CD90206794A3EFF2C16F8747A47D1
                                                                                                                                                                                                                      SHA1:E23E9CEA6A8DEAE8CC143AB748EC9E84F8205FCC
                                                                                                                                                                                                                      SHA-256:916653DE6EC324A156A49AF83D11B17B7E338E97D8DB629D5A8BE8B57E0EA639
                                                                                                                                                                                                                      SHA-512:60ECE4153E335FB90D712CF0C5CC2D22B1324BC92FA37B2CEFFA5DED5CD76C227259BBB7B8DCBBE6B026876D13101EF7BD92422292BD08736DAE91641DC978C5
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... M.Gd,..d,..d,..mT..l,..pG..f,...C..q,...C..n,...C..b,...C..`,...\..c,..d,...-...\...,...\..e,...\s.e,..d,..e,...\..e,..Richd,..........PE..L...a.._...........!.........r...............................................0............@......................... ...d....+...................................l......T...............................@............................................text...Z........................... ..`.rdata..............................@..@.data....$...........`..............@....rsrc................~..............@..@.reloc...l.......n..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5Network.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1051120
                                                                                                                                                                                                                      Entropy (8bit):6.670752367944595
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24576:Aul0ktv339DOBVXaIFP698DWk7PVmr0qwjb:A8sJVWAcwnH
                                                                                                                                                                                                                      MD5:2E3DB1CD1EC59D08706438258E86EA30
                                                                                                                                                                                                                      SHA1:BC20B1E40049386E6BEA3F448A6852BC879A8821
                                                                                                                                                                                                                      SHA-256:37275F3EA79D15A2792BF21F71F1DF825F201CF8B33AA1F94CA93D62D76B216C
                                                                                                                                                                                                                      SHA-512:0C0E0E02CCADC3F2B3F6C8CBF2C162FB73734B0B244C80048968A6FE268450A270A3F92B155DAF6268FEF246D26AD417E6CEC224133FD66E6FFB3A5394B04358
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........G;.x.;.x.;.x.2...7.x./.|.:.x..|.1.x..{.>.x..}.".x..y.?.x./.y.5.x...y.8.x.;.y...x...}...x...x.:.x.....:.x.;...:.x...z.:.x.Rich;.x.................PE..L...z._...........!................Q..............d.........................0.......k....@.........................0...<e..lT..T....@.......................P.........T..............................@...............4............................text...?........................... ..`.rdata..............................@..@.data...L8.......&..................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5PrintSupport.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):267760
                                                                                                                                                                                                                      Entropy (8bit):6.863402731081147
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6144:4Pt7KN5BjAMaTwmGyjh4C6Qiy8AoUL37fhcJ3I9VHHiy1Qfcz+IQlGXxDF4li7cn:4lE5Bj+Kyj2mF8kFOfkDe
                                                                                                                                                                                                                      MD5:83FB40D5AB3108F18832B78574404B62
                                                                                                                                                                                                                      SHA1:0F6AE59CA205CA75A8ECF02D0E0ED5203F894685
                                                                                                                                                                                                                      SHA-256:74E737DDA4F666C28F9543BDE9CEE526A18D0088A780B497AD7C1772B3CADD4E
                                                                                                                                                                                                                      SHA-512:8B9763C3AE94178A350E355F436BCC8B1802064EB2E968327AFA423688035C2AA3AE7989CB4D0F61231E1A7AEE86A2635626CCDCFCEECA3058D99520F4E38D1A
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............|..|..|.....|.O.}..|.O.y..|.O.x..|.O....|..}..|...}..|..}..|...y..|...|..|.....|.....|...~..|.Rich..|.........................PE..L....._...........!.........b......Q........................................0............@.............................o......................................d0......T..............................@............................................text...z........................... ..`.rdata..............................@..@.data...l...........................@....rsrc...............................@..@.reloc..d0.......2..................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5Qml.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2975216
                                                                                                                                                                                                                      Entropy (8bit):6.4996884499926635
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:49152:grHpbRcgtgEgnLDYZeQok3e3QiBMKbjcbKYI1YLTFXrwWGw6cTWptNrSdSG779LZ:ARcgOnLDYZeQokwuT5E7NrSdSG779LL9
                                                                                                                                                                                                                      MD5:7CDA5037206A57CADD50B5F032876A8E
                                                                                                                                                                                                                      SHA1:314B671B27E9602A66396EC37BDD6E70BB180D92
                                                                                                                                                                                                                      SHA-256:E45F26EBBC2B0499E0E90F1666FD13F1BB2BED1073E828D30B6A3A70599D4BC9
                                                                                                                                                                                                                      SHA-512:1450A79B017B4809C83C2FC4EF53DF926E3A725959B6E378C5A55C853D2151A2BA70272848962931C58596FB4174601E3DEFEDB120FD0A211D57BE9D1908EE3E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........9V..jV..jV..j_..jZ..j...k\..j...k]..j...kJ..j...kR..j...kR..jB..kS..jV..j..j...k...j...kW..j...jW..jV.{jW..j...kW..jRichV..j................PE..L......_...........!.........X............... .....f..........................-.....I.....@..........................J$..`....).......+..............J-.......+.$.....#.T.....................#......#.@............ ...............................text...j........................... ..`.rdata...`... ...b..................@..@.data...t>....*..&...n*.............@....rsrc.........+.......+.............@..@.reloc..$.....+.......+.............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5QmlModels.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):350192
                                                                                                                                                                                                                      Entropy (8bit):6.598734428040625
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6144:hX6wb2uBTVgttAC/trZYzAZpebGUvteg0NYMr7XPqfQ3G/7fOTvFmqi9:3BVgXt9EAUGUQg/MfXQ0m/9
                                                                                                                                                                                                                      MD5:78E8091FEB2E6CE5646459DB0EA9E465
                                                                                                                                                                                                                      SHA1:1731D2D47CFE21394F208F7BAFF7EA1F2E702546
                                                                                                                                                                                                                      SHA-256:065C8D687DC74964123F4BB06319565B163B164AB09DADC1EB6929EE19755735
                                                                                                                                                                                                                      SHA-512:B3FDF745336C7473B9AFA57432379FF32CA5105EB956779DA16DE3CD55453AF54E1420E5F514A1BD9F78107DAD4EF719089640CFD0F144D8B7A36E3E39E319D5
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+c..o..o..o..fz[.i..{i.m...m.y...m.e...m.j...m.k...r.j..o..9...r.|...r.n...r7.n..o._.n...r.n..Richo..................PE..L......_...........!.....|..................................................p......^y....@..............................[..Lm....... ...............<.......0...?..D...T...................P...........@...............X............................text...k{.......|.................. ..`.rdata..ZT.......V..................@..@.data...."....... ..................@....rsrc........ ......................@..@.reloc...?...0...@..................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5Quick.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3489776
                                                                                                                                                                                                                      Entropy (8bit):6.735327359739455
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24576:wLAgn4tj+U6JL9iji/2LzruK/bEdKUEAWzeauejEM5OmTi/bIi6+LPt1rt83FCbW:zT1HZEHr7OCsKbKzVZPXMC0FEUO71
                                                                                                                                                                                                                      MD5:07266E7D049AC4499F34CE281F3A50D7
                                                                                                                                                                                                                      SHA1:257968090B95FAE67F92F82DB9CAB1F7613D75E3
                                                                                                                                                                                                                      SHA-256:5F246016691FF883243EE9B3C9215EB16B859B12AEFC5F4BBD2FBDA3911883DE
                                                                                                                                                                                                                      SHA-512:D7F9CE2FB11DE178D6D38A5580C503C21FED6777067B8A8259F9FE35B44047040B705903DB4ED3FBAC821806CBD5CA1DB0F5FCBEC68CDC49282DC0E63A3257C3
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b...&{.&{.&{./.p.*{....,{.....!{....?{...."{...,{.2..#{.&{.p....{...'{....'{.&{t.'{...'{.Rich&{.................PE..L......_...........!...... ........... ....... ..............................`5.......5...@...........................(.._..pT/.@.....2..............$5.......2.......'.T.....................'.......'.@............. ..............................text.... ....... ................. ..`.rdata........ ....... .............@..@.data...d.....1.......1.............@....rsrc.........2......~2.............@..@.reloc........2.......2.............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5Svg.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):264176
                                                                                                                                                                                                                      Entropy (8bit):6.70077376714061
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6144:71lj55OgW5ODJ+bXhE4o+K08LJw8Rk8bOvR1yGaucmSJyUIEDv8ma4y4GeO43iUM:7bJ+bXK4o+K08ROvR8ucmSun5h
                                                                                                                                                                                                                      MD5:EF0D5A2DC1D7A921F2BB0EB3EEF2E481
                                                                                                                                                                                                                      SHA1:CB167EC49221EC5245FD9BFF7E7EED6C7CF38D51
                                                                                                                                                                                                                      SHA-256:ADE28D4CBAC1E033468CB48F380352F0DF7FBBCE03261C48827B8A5ED7A1548E
                                                                                                                                                                                                                      SHA-512:ECB41CB9BC4A4470F039D02441A0C0E8C596FFD55DEB924E516C4C8FC880357D5D2D1EF36E63B1303FAA7DAC5C921679A0F405C39F6E0B32B3746C972653B789
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........r..j.o.j.o.j.o.ck..l.o..|n.h.o.~xn.h.o..|j...o..|k.`.o..|l.i.o..cn.m.o.j.n...o..cj.g.o..co.k.o..c..k.o.j...k.o..cm.k.o.Richj.o.........PE..L......_...........!.....T...........\.......p.....f......................... ............@.............................@}...<..................................8/......T..............................@............p..\............................text...{S.......T.................. ..`.rdata..NL...p...N...X..............@..@.data...............................@....rsrc...............................@..@.reloc..8/.......0..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5WebSockets.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):122352
                                                                                                                                                                                                                      Entropy (8bit):6.478532411200339
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:v2w9BY91mB0E7PH4r+/yr5Cmwk7FyM0DO2:v2wPPHwhwk7FqJ
                                                                                                                                                                                                                      MD5:60BF6B69FB580B6F719394AA8277503C
                                                                                                                                                                                                                      SHA1:CB37BAF5B1648B805A07E0DEA59C3A0A65345835
                                                                                                                                                                                                                      SHA-256:B8F83F5E56622AFCC257FA6883AD2DDC24934F21619037DDC637C691ACB80F33
                                                                                                                                                                                                                      SHA-512:64CED39966851953B5ACB6769DA72AD6AB19E2D42515B6ABD0F6F1EDC621137E0451604E5EF95C228065C54463D2AD4BA0707984AA516FEF6F8C72D04DCB94D9
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3+E.]xE.]xE.]xL..xA.]x..\yG.]xQ.\yG.]x..XyP.]x..YyO.]x..^yF.]x..\y@.]xE.\x.]x..XyV.]x..]yD.]x..xD.]xE..xD.]x.._yD.]xRichE.]x........PE..L......_...........!................&...............................................@.....@.........................`5...!..0W.......................................)..T....................*......`)..@...............4............................text............................... ..`.rdata..............................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\Qt5Widgets.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4459504
                                                                                                                                                                                                                      Entropy (8bit):6.83333130328421
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:49152:ypo1FNXS+dh75PMvZZNNt+iIo5uL5Sdbtye6cEu0n:oIPqZZUfwusae6ju0n
                                                                                                                                                                                                                      MD5:DA70580648A398AB1C5336EE9EC631CA
                                                                                                                                                                                                                      SHA1:FA67A8A2D7F7930A45974DCB7A12E56914BF0A57
                                                                                                                                                                                                                      SHA-256:600285754E7EEE7239B9D252DBED5C9D2C9C4C432751B8953DCB2E8B45E0408A
                                                                                                                                                                                                                      SHA-512:83D85DF1717A5B1DD5B31F5AB33E73D1442027A719AF7FDCD20D578598F436D63E7CF58287CBE34DBEE8D5B0464A68DFD471D8EC6A95A3168EB8639864A7ADFC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........t..t..t...:.t..W...t..W...t..W...t..W...t.....t.....t......t..t..x......'t......t....V.t..t>.t......t..Rich.t..........PE..L....._...........!......*...........*.......+....e.........................0D.......D...@..........................Y6..'....>.T....`A...............C......pA.`....o5.T....................p5......o5.@.............+../...........................text...:.*.......*................. ..`.rdata..j.....+.......*.............@..@.data....w....@..r....@.............@....rsrc........`A......4A.............@..@.reloc..`....pA......:A.............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\d3dcompiler_47.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3466856
                                                                                                                                                                                                                      Entropy (8bit):6.444422172074855
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:49152:PyZ9lnpmVm/w+EwVOmufvkQS8MH2J9CqS5Sqr88pPWW5KhQYPsXqUiQ6:E9fWAwVBC8MH2JNSF8+YPsXqUT6
                                                                                                                                                                                                                      MD5:C5B362BCE86BB0AD3149C4540201331D
                                                                                                                                                                                                                      SHA1:91BC4989345A4E26F06C0C781A21A27D4EE9BACD
                                                                                                                                                                                                                      SHA-256:EFBDBBCD0D954F8FDC53467DE5D89AD525E4E4A9CFFF8A15D07C6FDB350C407F
                                                                                                                                                                                                                      SHA-512:82FA22F6509334A6A481B0731DE1898AA70D2CF3A35F81C4A91FFFE0F4C4DD727C8D6A238C778ADC7678DFCF1BC81011A9EFF2DEE912E6B14F93CA3600D62DDD
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Q...0.X.0.X.0.X=.DX.0.X=.EX.0.X..DX.0.X..FX.0.X.0.X.0.X..@X.0.X..EX.0.X..AX.0.X..XX@0.X..BX.0.X..GX.0.XRich.0.X................PE..L...n..R...........!......1.........7.0.......1..............................`5.......5...@...........................1.u... .2.d.....2.@.............4.h<....2....p...............................h...@.............2. ............................text...%.1.......1................. ..`.data...<.....1..^....1.............@....idata........2.......1.............@..@.rsrc...@.....2.......1.............@..@.reloc........2.......2.............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\libEGL.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):23024
                                                                                                                                                                                                                      Entropy (8bit):6.3575722696909756
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:BH0ECfljwSVn5jd2J5uIVndDGn7Dgf2hOi:BtCZn5jMruIFdDGn7Uf2hOi
                                                                                                                                                                                                                      MD5:371AEB50F7816108B346B67EF2B11E1A
                                                                                                                                                                                                                      SHA1:5DE780B46D7663D1615727EDABA32B5709286D38
                                                                                                                                                                                                                      SHA-256:12903D93A7F57B479401602A533849E6F813FF5C2C92F3A02D468FC98E7AC1D5
                                                                                                                                                                                                                      SHA-512:4AFF94ADBD97948766C7839220E15000A4DEFB7D46B5502872B16225E8C5B85B6B674B632455AFBB3DB729D5F2E9666B32B8DB282EA3499EBD84FE4CE11D9631
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............u...u...u......u...t...u..t...u...p...u...q...u...v...u.E.t...u...t..u.E.p...u.E.u...u.E.....u.......u.E.w...u.Rich..u.........PE..L....._...........!.........*...............0............................................@..........................5.......>..d....`..H............>.......p.......1..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......4..............@....rsrc...H....`.......6..............@..@.reloc.......p.......<..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\libGLESv2.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2937328
                                                                                                                                                                                                                      Entropy (8bit):6.526679153933017
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:49152:OOs7dcfIlADvQs46Bw6OtkrSjfM0E66+k:cdcuA8s4Fte
                                                                                                                                                                                                                      MD5:7FF6836C626BBC7F0833A66AA77A7A7F
                                                                                                                                                                                                                      SHA1:9AD21C1A5DF940999BA9F884D21868D3B69E7155
                                                                                                                                                                                                                      SHA-256:8CFC024D09A6784486DA7DC0EBFD90C0C8136B27C08EC1C3F352CD4FA43B9273
                                                                                                                                                                                                                      SHA-512:8FF378B9D2A1058396FF5E9795F7BD25FC3092F94B9274447C849C19294569197F6920BDA448A3E2C06B012BA1468D75F2B26ED1BD4E54191F28CA209BF41697
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........M6M.#eM.#eM.#eD..e].#e..'dG.#e.. dD.#e..&dV.#e.."dI.#eY."dJ.#eM."eO.#e.&dC.#e.#dL.#e..eL.#eM.eL.#e.!dL.#eRichM.#e................PE..L....._...........!......"..&......}. ......."...............................,.....;a-...@...........................*..\...l*......0+.P.............,......@+.t....'.T....................'..... .'.@............."..............................text....."......."................. ..`.rdata........".......".............@..@.data.........*......|*.............@....rsrc...P....0+.......+.............@..@.reloc..t....@+.......+.............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\libeay32.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1297408
                                                                                                                                                                                                                      Entropy (8bit):6.797045895691215
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24576:VUT+idPQfrZSZ9is0eiJUHV3fMPmBH0K6gElgzx9KlHGMQ7PHnq51FdZoYff9:EiZSZK2jHd6lHGMQ7PHq/XZoSf9
                                                                                                                                                                                                                      MD5:732928B0091928B1DCCA5AD7D908E58D
                                                                                                                                                                                                                      SHA1:E2D52810BA6C665A75ACE33DC1D963123A6A50D7
                                                                                                                                                                                                                      SHA-256:C28EB9E000A4232F918A88159FCF376FD4EBE706024DE86DE4E371433859D320
                                                                                                                                                                                                                      SHA-512:5CFF31C15BA76375FFA1E1C908177DC4AE5BC83E8488EAA2D73D9C98BD96A758E15180C1F3DD6928A6D22259477AA6449359CB2DF9589D5201781AF07A1091A9
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8o..|..I|..I|..Iuv+Ij..I.f.H~..I.f.Hv..I.f.Hv..I.f.H{..I.j.Hw..I|..I...I|..Ii..I.g.H<..I.g.H}..I.gGI}..I.g.H}..IRich|..I........................PE..L...;..]...........!.........j............................................... ............@.........................0...........h....p..H...............................T...........................(...@...............t............................text............................... ..`.rdata...>.......@..................@..@.data...t........`..................@....rsrc...H....p.......&..............@..@.reloc...............,..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\opengl32sw.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):15995904
                                                                                                                                                                                                                      Entropy (8bit):6.353584600934879
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:393216:rNkEXgt/UOdyRLjqkmbBDrta60HYUnuedxO0g//NuPyEMO32ovq:rN1QtXdyRLjqNbBDrta60HYUpO0Q/NuZ
                                                                                                                                                                                                                      MD5:8B197F55264A44B7B25046F7BA5BD7D2
                                                                                                                                                                                                                      SHA1:CEF69E168160968E00FFFFA136E1AF7819E7C0CE
                                                                                                                                                                                                                      SHA-256:25AE7577E066FA80519A8F1C314B15CDD22E4A8D3ECD2A36ECCC79E40714A91D
                                                                                                                                                                                                                      SHA-512:6AF2B1B17A7E3460099359A6750221AACB8F9CE0E80B346DBAFD2CBD8E579543B980F98E0AEB199E0781A045C9D6A7F2F11C8628F960C13550328487B7FA9154
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l%..K...K...K.......K.......K.......K.;.....K..PH...K..PN...K..PO...K.......K...J...K..PO...K..PN.I.K..PC...K..PK...K..PI...K.Rich..K.........PE..L.....`W...........!..........H......D....................................................@..........................v.....t...........................................T...........................X...@............................................text............................... ..`.rdata....<.......<.................@..@.data...pp... ......................@....gfids..............................@..@.tls................................@..._RDATA..............................@..@.reloc..............................@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\bin\ssleay32.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):281600
                                                                                                                                                                                                                      Entropy (8bit):6.362792344200413
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6144:yqQcCHyQdCb4R7sUHmDP/Cl3QmedVi3fL3ldtQBRdrQJq7av4vX0WezQ0RYA+Ooz:jQcCHyQdCb4R7sUHmDnCl3QmedV2fL3w
                                                                                                                                                                                                                      MD5:5856074EE91B0F315E2C436F306EDA09
                                                                                                                                                                                                                      SHA1:42A222BC006E14E9C2DDBFE6197D201EC842B557
                                                                                                                                                                                                                      SHA-256:F15F2E0484BF015856FAAD6AC54CB4A6E8751806C8A9644DA32BD58F9C55521B
                                                                                                                                                                                                                      SHA-512:7D9D0C6D15887F935A0AB4034912A147CB0E47A8208009A7310874271502F691EEB86DE184A0CF3E32C6999CC6BF8A2FFC629E0015E9C2A0DCAABD39617E7151
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P4+N.UE..UE..UE..-...UE.F=D..UE.{1D..UE.F=@..UE.F=A..UE.F=F..UE..<D..UE..UD..TE..<A.&UE..<E..UE..<...UE..<G..UE.Rich.UE.........PE..L...P..]...........!.....,... .......5.......@............................................@..............................).. ........P..H....................`...%......T...............................@............@...............................text....+.......,.................. ..`.rdata.......@.......0..............@..@.data...D1..........................@....rsrc...H....P....... ..............@..@.reloc...%...`...&...&..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\audio\qtaudio_wasapi.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):89072
                                                                                                                                                                                                                      Entropy (8bit):6.536218125453265
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:uLAHXpkWC/CkCvCFCiW124BuTU8lF9+f7BdtenWWM11oD+k0B+C4f09IPKkwYrYK:uLAHXpkk12LU8r9+jBdteBh+k0B8fZPn
                                                                                                                                                                                                                      MD5:A3CE61417B3D6049B14BD6E07642FA41
                                                                                                                                                                                                                      SHA1:A0A82923F6B6455BE5644E33F2B6E5365CF8D4E7
                                                                                                                                                                                                                      SHA-256:2961E1C94FD641312B7747A9B2D07F05B420C5C68C29242283F1B7F182E427A2
                                                                                                                                                                                                                      SHA-512:91312A776D48B801CE946A8448F73549686CEA1201C7E21DBC41E972DDBBDD2CDAEE2E255BA3B3B961E70306CFE00BEEC2664EE6AA872073896624CE4C3E757D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p.H.4.&.4.&.4.&...".>.&...%.1.&...#.,.&...'.0.&...'.0.&.=...>.&. .'.3.&.4.'...&...#.=.&...&.5.&....5.&...$.5.&.Rich4.&.........PE..L......_...........!................................................................V.....@..........................................`..P............@.......p..........T...........................8...@...............\............................text............................... ..`.rdata...T.......V..................@..@.data........0......................@....qtmetad[....P......................@..P.rsrc...P....`....... ..............@..@.reloc.......p.......$..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\audio\qtaudio_windows.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):53744
                                                                                                                                                                                                                      Entropy (8bit):6.514657800964626
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:JymY3USpNcShD+t9QS6bkZYKrChimrJvFUfw:kmY3UsVI9H6xiChim1v/
                                                                                                                                                                                                                      MD5:88577BFC1A8F34CBF575205DB3F1CB31
                                                                                                                                                                                                                      SHA1:CB9D72FA0DD97CD4008015551CC5764C9BE328C7
                                                                                                                                                                                                                      SHA-256:868C105861B6FB2207997A9B13D52B8CC0A22CE37D63382A869FD33277526213
                                                                                                                                                                                                                      SHA-512:4C3D65ADFAEE850E40F2725FCA62A11F3B6652C8ADAD2E7372222E53F77C538A1904B4A7ED6DF8167DD08D6BAC628160CAA3EB5906673D2F9A467947D85C45B8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0../t..|t..|t..|}..|r..|..~}v..|..z}a..|..{}~..|..|}q..|.~}p..|`.~}}..|t.~|...|`.{}v..|.z}s..|..}u..|.|u..|.}}u..|Richt..|........................PE..L......_...........!.....f...P......%l....................................................@.............................|...............P.......................@...\...T...................h...........@............................................text....d.......f.................. ..`.rdata...6.......8...j..............@..@.data...............................@....qtmetadb...........................@..P.rsrc...P...........................@..@.reloc..@...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\bearer\qgenericbearer.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):44528
                                                                                                                                                                                                                      Entropy (8bit):6.480493686402605
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:EYnMoTheMJroMOENIFanla6PK2Jbga+5+yAXmjkJuDZbjV52dDGFeTUf2hl:Xhe8O6QalaYbga+PjkJuDZbn2VTUfy
                                                                                                                                                                                                                      MD5:57F3FFCF6A99ABDECA93D0BEBD9F05D8
                                                                                                                                                                                                                      SHA1:F1B7038C4F6CAD75B8A6D115255421D60F1DE04F
                                                                                                                                                                                                                      SHA-256:44B59C980CA26ACA133BD3842155C55EB30630853C3C316E1955415E10B34C0F
                                                                                                                                                                                                                      SHA-512:CBE0ED19D03540FFEF93C4028BA7BF170CA82D1BFD15D432C7FB0EDF96E450C9DDD85701B3EF52EDABAC96FD3CB6E3DA2EADF4ED1DE3907E986E8F3D64DD3B08
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Dq..*"..*"..*".."..*"m.+#..*"m./#..*"m..#..*"m.)#..*" .+#..*"..+#..*"..+"..*" ./#..*" .*#..*" .."..*" .(#..*"Rich..*"........................PE..L...H._...........!.....D...L.......J.......`......................................;.....@.........................Px..|....x..........P............................n..T....................o.......o..@............`...............................text...DC.......D.................. ..`.rdata...7...`...8...H..............@..@.data...............................@....qtmetadj...........................@..P.rsrc...P...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\generic\qtuiotouchplugin.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):58864
                                                                                                                                                                                                                      Entropy (8bit):6.60633814610451
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:QNa1alH+mupJQnk4RBWaDMGRZPwa3CocG4jUfV:o3lH+QDMGRZPwq4c
                                                                                                                                                                                                                      MD5:CF779FF4BAD071CE54550437A2730955
                                                                                                                                                                                                                      SHA1:2EAF309EA638320BCB9A775C748E294DA57ACDED
                                                                                                                                                                                                                      SHA-256:D132BBE8ED3EF8288B7089366F5DAF8AD732354A051BA661406BD57734C18FFA
                                                                                                                                                                                                                      SHA-512:5C7384C0EA4271193F88B31A1DCD28A9C74065163DEEBF85D891F0832A285871E8A867794FFFC79B50AD9F4D93CCE56B2A3BDDDA86160499D5BF8EF5918AA6CC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(kL.l.".l.".l.".er..h."..e#.n.".xa#.n."..e'..."..e&.f."..e!.n."..z#.k.".l.#..."..z'.i."..z".m."..z..m."..z .m.".Richl.".........................PE..L...A._...........!.........J......*...............................................1U....@................................P...........X...............................T...............................@............................................text....~.......................... ..`.rdata...1.......2..................@..@.data...T...........................@....qtmetadi...........................@..P.rsrc...X...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\iconengines\qsvgicon.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):35824
                                                                                                                                                                                                                      Entropy (8bit):6.522245949878045
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:crdZm5mjw1lQR8Z3Zf3V+hFem0wKk84XmydDGFUf2hE:6u1lQQ3Zf3V+Lem0wKk849kUfP
                                                                                                                                                                                                                      MD5:A85EA17FB2CA9258E71D0A60667EAE6A
                                                                                                                                                                                                                      SHA1:9BC4333321611769A51BCB5292C0517C227614C6
                                                                                                                                                                                                                      SHA-256:5456152400A84C153728007BD1C7D549788D2300441ADDD40C18D7E17F757856
                                                                                                                                                                                                                      SHA-512:EAD8A715F75C82FE85A2D475010D8C880B13700C847840810BD6F75F6A4A418DED406133404A1C3D196461D676F8819A7BFF25E556D25250D031E513303F81EB
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............................................................B.........X..B......B......B.v....B......Rich...................PE..L......_...........!.....8...8.......>.......P............................................@.........................0]..x....]..........H............p...............T..T....................U......0U..@............P..x............................text....6.......8.................. ..`.rdata...%...P...&...<..............@..@.data................b..............@....qtmetadj............d..............@..P.rsrc...H............f..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qgif.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):34288
                                                                                                                                                                                                                      Entropy (8bit):6.411504035676847
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:aL5MPkjurnzyuVlfehyScQeOYGuOU9OOHhTNAYFdDGzUf2hW:aNYnzyuLeEfQeFGuOU9OOHhZAYFOUf5
                                                                                                                                                                                                                      MD5:E3A1338EFADABB9FC23D955AF9A7E070
                                                                                                                                                                                                                      SHA1:DFBE82B183FFF002A2E841D73474C78F646FDBA2
                                                                                                                                                                                                                      SHA-256:F1FA3BFEEA6A600F2C6D209775154CEE349B7F687CB4F7213A8CAD8870DBB812
                                                                                                                                                                                                                      SHA-512:0413A6116E227FA6A3DD7DA6FA4BB8DB59ED64FC16E37BFA49CA28C687FE791941B3A23193796EB0ECE458E87F9F78F587B3A1FE0F188B63B9148037997DF1A2
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........O)..!z..!z..!z..z..!zh. {..!z.. {..!zh.${..!zh.%{..!zh."{..!z%. {..!z.. z.!z%.${..!z%.!{..!z%..z..!z%.#{..!zRich..!z........................PE..L...1._...........!.....:...0.......A.......P.......................................=....@.........................p\..t....\..........@............j..........d...$T..T...................0U......xT..@............P...............................text...t9.......:.................. ..`.rdata.......P.......>..............@..@.data........p.......\..............@....qtmetads............^..............@..P.rsrc...@............`..............@..@.reloc..d............d..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qicns.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):38384
                                                                                                                                                                                                                      Entropy (8bit):6.558386736803828
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:nwFo5IoYXrOOmYaRCNOq9QNdhVJ0hBEH3lMwAJXGdtpZmPdDGGzUf2h2:wWBIf9QvJgEX6wAJXGdtpZmP3UfP
                                                                                                                                                                                                                      MD5:862A826020DFE7AB690900A87250992D
                                                                                                                                                                                                                      SHA1:983117858F162F7EAB3F4AEE6E0D9619E20637EF
                                                                                                                                                                                                                      SHA-256:F96E413DC1B8A67C025B3D1769241EE96DD8B079B367A6C868D650A6B68154C4
                                                                                                                                                                                                                      SHA-512:A71CDFBA3023934D0BFE25A05D2FDA00F60CAAF77122CC0D52C7C6F6555EBF43E13555B563A564023C02E9419471A8ED325D182508AD276517C68C9691D5704A
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......pj..4...4...4...=s5.2....d..6... `..6....d..'....d..>....d..6....{..1...4........{..6....{..5....{Y.5....{..5...Rich4...................PE..L......_...........!.....:...@......jA.......P............................................@.........................@e..t....e..........@............z...............\..T....................]......@]..@............P..<............................text....9.......:.................. ..`.rdata...+...P...,...>..............@..@.data................j..............@....qtmetadx............n..............@..P.rsrc...@............p..............@..@.reloc...............t..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qico.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):32240
                                                                                                                                                                                                                      Entropy (8bit):6.4704292078665375
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:1wLKUeP1ob4OgufLCJGqU2SZ6HseQdDG0Uf2hKT:4KUeP1WyufLCJGqU2SZ6HseQ9Ufz
                                                                                                                                                                                                                      MD5:7200F8E1AF1C6A60501D5FEF7772FD0B
                                                                                                                                                                                                                      SHA1:5F2BAC81A60F7FDFBE8B1A01F111660A3614D679
                                                                                                                                                                                                                      SHA-256:35CF0AE6BCD1B8322482D40BF2DD693E276548885284B88E6631AB18A0C2C60E
                                                                                                                                                                                                                      SHA-512:097835D4C8C61C2489E831B31A8BB6F2FEEA277439D6697B6E3165CCB6E4758986C9A1FA754696DA53B6005A041156FF8BC455A71DC31EA799F5891348A07F22
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z.O..d!..d!..d!......d!... ..d!... ..d!...$..d!...%..d!..."..d!.. ..d!..d .d!..$..d!..!..d!.....d!..#..d!.Rich.d!.........PE..L...1._...........!.........4......;4.......@............................................@.........................`M..t....M..........@............b...............D..T....................E.......D..@............@...............................text....,.......................... ..`.rdata...!...@..."...2..............@..@.data........p.......T..............@....qtmetad.............V..............@..P.rsrc...@............X..............@..@.reloc...............\..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qjpeg.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):374256
                                                                                                                                                                                                                      Entropy (8bit):5.647982656907108
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6144:QsC804cB4tEXoOitMk5R8vsLK0LXz5pmglF90l7s0aGajl8Z9cg:Qr4bOzk5R+s5LFg9cg
                                                                                                                                                                                                                      MD5:438B696A9811CD821BBE2C54B5C1B4B1
                                                                                                                                                                                                                      SHA1:55EB74A0015228B1E6C1DC97E6F427C9DC804587
                                                                                                                                                                                                                      SHA-256:84C23191B5E35EAF899358C21445A5377845C0653668BBD99B1AA8796E0248C7
                                                                                                                                                                                                                      SHA-512:961ED9CFCD61A1FC32DE89CB97100AAA9A9225C80673B2176975BF62AF7F3A0E77A91FB723ED52C553E10A6F754A5E8C8085BDFBD56EF2DE8144C53BF41F4E91
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......a(a.%I..%I..%I..,1../I...&..'I..1"..'I...&..0I...&../I...&..!I..9.. I..%I...I..9...I..9..&I..9..$I..9..$I..9..$I..Rich%I..........PE..L...X._...........!.....................................................................@......................... u..t....u..........@............................l..T....................m...... m..@............................................text...$........................... ..`.rdata..(...........................@..@.data...............................@....qtmetad............................@..P.rsrc...@...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qsvg.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):28656
                                                                                                                                                                                                                      Entropy (8bit):6.306194975087341
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:WV5VVvwZ12uh991MD9dhQwe+oQQUcesJbT73dDG5Uf2hg:IvwZ12aC9Qwe+ZQUbsJbTLwUfX
                                                                                                                                                                                                                      MD5:F304A2C8067F804D25B98D360E92829F
                                                                                                                                                                                                                      SHA1:DAE1D07DE8C33912FF4FFC957F8817B2B3E8293A
                                                                                                                                                                                                                      SHA-256:E45893BB7DB31BFD32E87DC7A6B02709FCA36EB83A25AEDC45A39178EC80051E
                                                                                                                                                                                                                      SHA-512:5BC122BEA8DE687820932666C6B76BB153B115263B31A40FD7823A2A36EBC88B27626E06E3A6C5DC5F62970C8C7E9C094984B494D7F279BFDB9BAC7A8C2964CA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........................................................B........D...B.....B.....B.u....B.....Rich...................PE..L......_...........!..... ...4.......%.......0............................................@..........................<..t...T=..........@............T...............4..T....................5.......4..@............0...............................text...T........ .................. ..`.rdata..h ...0..."...$..............@..@.data........`.......F..............@....qtmetad.....p.......H..............@..P.rsrc...@............J..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qtga.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):27632
                                                                                                                                                                                                                      Entropy (8bit):6.3327508725091315
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:kg8gKOwVg6VjbFnOfEIzPMoVhWyrsdnyBSxQrrVIyndDGdEDgf2hR:kPxOQXOfEnoVh5/BSxQrxIYdDGKUf2hR
                                                                                                                                                                                                                      MD5:367C723591FDE64C38202D4C0F5ECFDE
                                                                                                                                                                                                                      SHA1:C13D74F417601C656F343F00D15E56517EE03B6A
                                                                                                                                                                                                                      SHA-256:CCD620E74045D9C9157903120140B97419CBBE91FD43337E640C67CD4522072A
                                                                                                                                                                                                                      SHA-512:31C084BA00E094E30C6F912ECD045E19C4451D8783A80DC99B99098F84C5500665A35AC901B0FDE84D04DF898AD67448E83539A7DAA4928E8C78F798B359B256
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&...b...b...b...k...d.....`...v.`.....p.....h.....a.......g...b...........a.......c.....b.c.......c...Richb...................PE..L......_...........!.........2.......$.......0............................................@.........................`?..t....?.......p..@............P..........(....5..T....................6......(6..@............0...............................text...d........................... ..`.rdata.......0... ..."..............@..@.data...L....P.......B..............@....qtmetadu....`.......D..............@..P.rsrc...@....p.......F..............@..@.reloc..(............J..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qtiff.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):353776
                                                                                                                                                                                                                      Entropy (8bit):5.798077806376592
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6144:BpYIdJpn0zXsT6DP64icIkjEkaNCTjM+8kBHWNFnHJXGFkDQDWr:jYIp06+IkjeNGjIkZZKr
                                                                                                                                                                                                                      MD5:49B6F0BA901F649AB110744E34076951
                                                                                                                                                                                                                      SHA1:4C9EEBADB5B86147EA94F48EAA6705A4B75B3E61
                                                                                                                                                                                                                      SHA-256:5128AEDF4BD9B747AC848BF85E0FFB99BA814BD8E671ADFF7D26391D31259050
                                                                                                                                                                                                                      SHA-512:B42A13F0215A194F77781AC74CF55C24A0F0BC99CC872EA06125CFE12FFEF93ADD0665991339DB3B7962262E6D381F20227DA3272360450B53993D06BC0EC98A
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................5...F..........F.....F.....F.............&......................Y.........Rich...........PE..L......_...........!.........^............................................................@.............................t...4........P..@............J.......`......d...T...................p...........@............................................text...$........................... ..`.rdata...........0..................@..@.data........0....... ..............@....qtmetad.....@.......$..............@..P.rsrc...@....P.......&..............@..@.reloc.......`... ...*..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qwbmp.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):26608
                                                                                                                                                                                                                      Entropy (8bit):6.424614950505374
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:j9NLeETizwsASWjsUE2rBiQtp4VmsdXurvZJ4EndDGgDgf2hcU:xNLXiHAS+E2rBi7mbrvZJPdDGgUf2hcU
                                                                                                                                                                                                                      MD5:7A05C8435FB60F43958120B22B653B54
                                                                                                                                                                                                                      SHA1:79D7122E4AB89DC9978FCD48FCBF0C6B8AE3F690
                                                                                                                                                                                                                      SHA-256:7C946F750413716A714884C8836D24AA6D2561B48E7F3397BAB88AF348E078EC
                                                                                                                                                                                                                      SHA-512:74800A623E4789C245095B6AD0CC03EC8EB00431487E7977BD3BC5CBF0278480474D74FD194873F220DD5682EEC88864095659315F68D650C1CC8B40435B182C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%...D.D.D.<r..D.Q+.D./.D.Q+.D.Q+.D.Q+.D..4.D.D..D..4.D..4.D..4...D..4.D.Rich.D.................PE..L......_...........!................[%.......0.......................................\....@.........................P<..t....<.......p..@............L...............3..T....................5......P4..@............0...............................text............................... ..`.rdata..^....0......."..............@..@.data........P.......@..............@....qtmetad~....`.......B..............@..P.rsrc...@....p.......D..............@..@.reloc...............H..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\imageformats\qwebp.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):412656
                                                                                                                                                                                                                      Entropy (8bit):6.72175950156531
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12288:llTSf8S+PHunhrYzVcS/CQVy7wycv+QrUwDHHgxgG:L08S+PO1OVcS/XVykyI+4M9
                                                                                                                                                                                                                      MD5:B9416990AF043CA8CFA668121184C05D
                                                                                                                                                                                                                      SHA1:4181D92E91704B961A22B51713705D53DDA0CF51
                                                                                                                                                                                                                      SHA-256:50FCF1FED7612AE4C346D7AE7DEC3EBBBD2AC31C5E954263A7BBC655502E3B03
                                                                                                                                                                                                                      SHA-512:E303E4B166ADA78DBE75639B73EFE275A0E4F49A1CD2DA5016E1F31A1A012AEE383E6ACC21D63561E78321B1E162EC9CFEC3915909E698D2064B1FB0DD33DE76
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~............gY.....p.....t.....p.....p.....p....Yo.......K..Yo....Yo....Yo....Yo5....Yo....Rich...........................PE..L......_...........!.....`........../h.......p......................................6b....@.............................t............P..@............0.......`...#......T...............................@............p..L............................text....^.......`.................. ..`.rdata..t....p.......d..............@..@.data...L ..........................@....qtmetadv....@......................@..P.rsrc...@....P......................@..@.reloc...#...`...$..................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\mediaservice\dsengine.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):249328
                                                                                                                                                                                                                      Entropy (8bit):6.60433177058215
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6144:cvrmV0Yz9nN8vIy/9fFhVGpz4FX+kmABj//TNmudDorfpng++hO:cTQ0YQwy/9fFhVGpz4hGmO
                                                                                                                                                                                                                      MD5:9B50FCC0A5B05E57E5FA79E90AE40614
                                                                                                                                                                                                                      SHA1:1309F865492AC2307B09F5638290B9D1BDF36C03
                                                                                                                                                                                                                      SHA-256:26E1916B58D688E28B5746B2D81C10A4A09C8FC13E78DB62BB590D8CD648FBA9
                                                                                                                                                                                                                      SHA-512:813A9BE26BE0DAFBBC30910D89F335505596177FE31F5885B99093BC7DC6267DEF482C077A13298AC3467476A75B773BF54F0B3A8E10503F8AB9614B01CF935C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......9a..}.f.}.f.}.f.tx..u.f..oc.n.f..ob.w.f..oe.x.f..og.y.f..pg.w.f.ikb.{.f.ikc.|.f.ikg.j.f.}.g...f..pc.?.f..pf.|.f..p..|.f..pd.|.f.Rich}.f.........................PE..L......_...........!.....V...\.......\.......p......................................E.....@.........................P...x...............H........................5..t...T...............................@............p...............................text...TU.......V.................. ..`.rdata.......p.......Z..............@..@.data....%...p..."...T..............@....qtmetad.............v..............@..P.rsrc...H............x..............@..@.reloc...5.......6...|..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\mediaservice\qtmedia_audioengine.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):55280
                                                                                                                                                                                                                      Entropy (8bit):6.443475230181386
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:OKP3SZO/dRMNQfEqLL0tc1wl6yEPSFSQEii7t0JSuK5VFVd9hkTBaY4/4qm8Ci3n:uO/oNQsptc1+6WmCBa/4qmHejEUfT
                                                                                                                                                                                                                      MD5:54F6DC69CD4C4B1C7AEF4305AA10C9C1
                                                                                                                                                                                                                      SHA1:A90EB329D9B359DBD561F0F57BB512AD29EF333C
                                                                                                                                                                                                                      SHA-256:E1207397F01FBA55A45224F1F451C2F0D946E3D2B7DF30BF67E81BF91FE8A114
                                                                                                                                                                                                                      SHA-512:1CC1F6D623519E06DF5FE943B04DC0CB99EFB42CDBB5C5F91DF79FF8DC9B086419E6474E71A835FB180F9994C728C6DC0289DB724704A2ABBB1C2DC857263020
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............}..}..}.....}.V.|..}..|..}.V.x..}.V.y..}.V.~..}...|..}..|.`.}...x..}...}..}.....}......}.Rich..}.................PE..L......_...........!.....R...j.......X.......p............................................@................................. ...........X.......................4.......T................... .......h...@............p...............................text...4Q.......R.................. ..`.rdata..PL...p...N...V..............@..@.data...............................@....qtmetad............................@..P.rsrc...X...........................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\mediaservice\wmfengine.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):173552
                                                                                                                                                                                                                      Entropy (8bit):6.564920633762343
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:hz8GUoKQkSqmFyCxkFZQCn3ePX1ggRkf943m6WjD/ISrN1dK1WgCOcf7Ka8G:hz8QkSqmFyCxM3q1ggRkf943m6WjD/Io
                                                                                                                                                                                                                      MD5:6346691E82EB3A5D8BEC7F39440A0581
                                                                                                                                                                                                                      SHA1:D53DDE9FEF595C0707BD394ECA1A4539FD3C1B72
                                                                                                                                                                                                                      SHA-256:3EB8D4CC2E2C9DC3C3703CAAEC8EFA9982D4B9C325541FB1642777110A9FB265
                                                                                                                                                                                                                      SHA-512:18044C918E284327E7CD7B3F94E51022E811B028810CC3457690E02A68B7307EAA8D96179863B64EC357D2651B718AF6660548BF488EED605D169BE90C4407BD
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$..........H....................x.......x.......x.......x...............5..........................................S...5......5......5.m.....5......Rich............................PE..L...z.._...........!.................................................................N....@.........................`...x...............H........................#..|...T...............................@............................................text............................... ..`.rdata..Z...........................@..@.data........`.......F..............@....qtmetad.............`..............@..P.rsrc...H............b..............@..@.reloc...#.......$...f..............@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\platforms\qminimal.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):701936
                                                                                                                                                                                                                      Entropy (8bit):6.797990435428196
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12288:49mqUd6YYwP+SbYFBsBHd5TsB0d3zV21lnjbduklgo123zDfEWmd9:49m4Y1+OYABHDsB0x41lnXIeZP
                                                                                                                                                                                                                      MD5:2AFD07C16A47B2CDE639D777CA7224EB
                                                                                                                                                                                                                      SHA1:9A08D20B993C9FB2D070D69CA8E7642DAC96DF19
                                                                                                                                                                                                                      SHA-256:81E59D22D5EFDC2DE84C75386BF136C9E4417EB9164DECAFB4198D28F29DBA8A
                                                                                                                                                                                                                      SHA-512:B69FACB50C0F8AC0C6E994BE16509190E57100905D6689B19F0CEBA2DCF13A9AE4EC17B2302B9214C32A25D2896AAFBEB8E9B4272E1A421B4020963AFBF87051
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./*..kKs.kKs.kKs.b3...Ks..$r.iKs..$v.~Ks..$w.aKs..$p.lKs.. w.jKs..;r.oKs.. r.bKs.kKr..Is..;w.LKs..;v.`Ks..;s.jKs..;..jKs..;q.jKs.RichkKs.................PE..L...7._...........!.....................................................................@.........................0...x.......@.......H.......................@<..H...T...................X...........@...............|............................text............................... ..`.rdata...O.......P..................@..@.data...D....`.......J..............@....qtmetad.....p.......V..............@..P.rsrc...H............X..............@..@.reloc..@<.......>...\..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\platforms\qoffscreen.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):629232
                                                                                                                                                                                                                      Entropy (8bit):6.802486576904191
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12288:FU09s7Ydf07Kw7AzQXSCjsBn8fztOnULj6TOZs8AADIDfEWmmPJ:Fs7q0+wIQXHsBnS4nULu6PZg
                                                                                                                                                                                                                      MD5:E32BF024E3527CBEFCD95E5DB93BB8FC
                                                                                                                                                                                                                      SHA1:705AC738B7AD7281F31A8197053515A87D7A5099
                                                                                                                                                                                                                      SHA-256:E8A180285147394733DB92A532025A36824EA9416B993DFDCAA8E19A66B8B1B6
                                                                                                                                                                                                                      SHA-512:032D5069C9E0819465C3F566D8555ABF6FE569B4B8B22E67083469F69EEF5AA03ACB99E0B42C90280AA36396AB6152A4D00A985AF5FD4C92D2428EA8ED2E7001
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u...............lv....."{.............."{......"{......"{......od..........$...od......od......od......od......od......Rich............PE..L...;._...........!.........b...............0............................................@.........................`...x...............H............~...........+..h...T...................x...........@............0...............................text...`........................... ..`.rdata..v%...0...&... ..............@..@.data........`.......F..............@....qtmetad.....p.......L..............@..P.rsrc...H............N..............@..@.reloc...+.......,...R..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\platforms\qwebgl.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):407024
                                                                                                                                                                                                                      Entropy (8bit):6.511569293536778
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6144:/Tq4StevYAunBi2Sq2DXfz3ARHh2nyPIqGfrTacq1iOCJ:/Tq4GewBrSdfODIbJ
                                                                                                                                                                                                                      MD5:C5A4F23C2F1CB00FAC420EF89AEEBB47
                                                                                                                                                                                                                      SHA1:2F1E73E076683C1F87081BB8EA97F007714FE8D9
                                                                                                                                                                                                                      SHA-256:30DFC5F5614427CDA0B4C97F25C2D6D19702562EC33E49C020768288CA1BEA7A
                                                                                                                                                                                                                      SHA-512:B67ACC32BE891CCAA2615B575D2A7B213917F3F6E78FAC28D03B76F3EB48D04AABC96AB77190ECA31FB3BCE965E53657E2D37B2B71C379B4E96D1BBFB1E3C019
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E(.T.I...I...I...1`..I...&...I...&...I...&...I..."...I...&...I...9...I..."...I...I..VJ...9...I...9...I...9...I...9...I..Rich.I..................PE..L......_...........!.........v...............................................p............@......................... \..t....\..T.......@........................a...G..T....................H......`G..@............................................text.............................. ..`.rdata...B.......D..................@..@.data...\...........................@....qtmetadz...........................@..P.rsrc...@...........................@..@.reloc...a.......b..................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\platforms\qwindows.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1219568
                                                                                                                                                                                                                      Entropy (8bit):6.8048735134931535
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24576:JDpg2QmODTJROAxb4KHA2N8L+0C+6eCKMY3EEsBIzdCGvpzdZRE:UhwJN2NSC/glTE
                                                                                                                                                                                                                      MD5:B2AF81698F607061986109B4A9004819
                                                                                                                                                                                                                      SHA1:36A789F49738DE6A10BFE82A282EE7E5FEFD396B
                                                                                                                                                                                                                      SHA-256:4D1EAF41136AC3FAEFB76F5CF2EFE8E7F8A11FD6A943A8B11F2F2A8BE5CFE19B
                                                                                                                                                                                                                      SHA-512:1786885032C3A7F4B4D6624DC0F1365322619F6ED92417A8671FE0A36E20016E677F254DA0909395A5B4D0F4C3403072EED8C1471DC3B729CB2D687C4F78B6C4
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......q..d5..75..75..7<.y7!..7...6 ..7...6?..7...6=..7...61..7!..66..7!..64..7...61..7...6...7!..6 ..75..7...7...6|..7...64..7...74..7...64..7Rich5..7................PE..L...q._...........!.....L...R....../K.......`......................................f.....@.........................._..x...._..........H.................... ..\...t!..T....................".......!..@............`..l............................text....J.......L.................. ..`.rdata..\6...`...8...P..............@..@.data....V.......6..................@....qtmetad............................@..P.rsrc...H...........................@..@.reloc..\.... ......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\platformthemes\qxdgdesktopportal.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):54256
                                                                                                                                                                                                                      Entropy (8bit):6.539788327915835
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:gZvYcLKYdZndpaOAmO0lu1GQ3xMesk255EUf7:YdLKYdZnWONO0luGQ3xMef255r
                                                                                                                                                                                                                      MD5:1F0503A2A3CB332AA59CAEE30F87F91A
                                                                                                                                                                                                                      SHA1:7865CA0B1EE0C2BAF06D354493128D9DC75EFB99
                                                                                                                                                                                                                      SHA-256:721EC33B6907DF5621C0A1F06D35DAE91372CCF71392046DFB926DE11CB577AA
                                                                                                                                                                                                                      SHA-512:17C8596B75323DF4684A347902AA54C9E5F12C602F9B6701A80426B4F8339F123B1136239BAD5549DFD17475148F78CE7CCE5058C2CEBF9BBBA9B00677963325
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V...................1.............1.......1.......1.......|...............|.......|.......|.a.....|.......Rich............................PE..L...?._...........!.....\...\.......c.......p............................................@......................... ...................X............................z..T....................{.......{..@............p...............................text....[.......\.................. ..`.rdata...B...p...D...`..............@..@.data...............................@....qtmetad............................@..P.rsrc...X...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\playlistformats\qtmultimedia_m3u.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):29680
                                                                                                                                                                                                                      Entropy (8bit):6.296558865998482
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:TWOC4NFPb0hOBHXjPL3VQ7i17hAXuXWwsP28ondDGWDgf2hyp:aKHB7LK74hXWwsP28mdDGWUf2hM
                                                                                                                                                                                                                      MD5:EF5291D51807167542BAC67168D712FA
                                                                                                                                                                                                                      SHA1:58ABBBD638AFC71479B846998F601ED2FA912A78
                                                                                                                                                                                                                      SHA-256:DE588A423926B9943737E16799048A97160DFA83E4D46FF9B2278FEA1DF11D9E
                                                                                                                                                                                                                      SHA-512:8A7AA886FB9257D7A245890852C3D0CF6DC5360F57F8BA1E4269B28807594CF040D192B8B0B2616B8400C6276BF117BBA634F522E179CF0D4511054DADAA7DC1
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3...]...]...].......].e.\...]...\...].e.X...].e.Y...].e.^...].(.\...]...\.&.].(.X...].(.]...].(....].(._...].Rich..].................PE..L......_...........!.........8......P%.......0...........................................@.........................@?.......?..........X............X...............4..T....................5......05..@............0..(............................text............................... ..`.rdata..\$...0...&..."..............@..@.data........`.......H..............@....qtmetadZ....p.......L..............@..P.rsrc...X............N..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\printsupport\windowsprintersupport.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):45040
                                                                                                                                                                                                                      Entropy (8bit):6.551151700286116
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:xXhkTJrc5LMOqZidKxpsi5IW3y7GRepuACpdDGpzUf2hmAj:xXhkTecOKxpn5B3y7GRepuACpUzUf2j
                                                                                                                                                                                                                      MD5:33861624E98D79EF87E1F936785E6F55
                                                                                                                                                                                                                      SHA1:774AB45BF39289F9723363AE8819A771C67B69DF
                                                                                                                                                                                                                      SHA-256:DC4F1C80081059AA1EC426A2D66AFD5163B04F7A3AC0AE275BF650D66894B492
                                                                                                                                                                                                                      SHA-512:9C56AE87D2702804F4DCC8C5CAC83860F8A2F5E8C59059AB29D176E08D56B801C7E9775FC02A7C27EE14CCFC31FF64F3F50E8D2B74823EC7B48077274E56BC87
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3U'.R;t.R;t.R;t.*.t.R;tE=:u.R;tE=>u.R;tE=?u.R;tE=8u.R;t.":u.R;t.9:u.R;t.R:t(R;t.">u.R;t.";u.R;t.".t.R;t."9u.R;tRich.R;t........................PE..L...4._...........!.....L...F.......Q.......`......................................yW....@..........................r......4s..........`............................h..T....................i.......i..@............`...............................text....J.......L.................. ..`.rdata...1...`...2...P..............@..@.data...............................@....qtmetad............................@..P.rsrc...`...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\plugins\styles\qwindowsvistastyle.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):133104
                                                                                                                                                                                                                      Entropy (8bit):6.518625487357124
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:Ef08LJXP50EuapXuJWd62ymc7xliHCTBIm2/40mwr6D5RXffv3xf6D:ufFRQLTBImI40mwr6D5RXffv3p6D
                                                                                                                                                                                                                      MD5:53AF56EA898BB82775FDD0F940C429D2
                                                                                                                                                                                                                      SHA1:5675FD1243EA87E59256B05E5A7C6C64298312EA
                                                                                                                                                                                                                      SHA-256:547606FC8A6B20A2616A4F390C6CF0E7AA713F6AD53BAE23C8D1B021885AAB0E
                                                                                                                                                                                                                      SHA-512:401F9B346A3DA18E750CF26CC05E1013EC8446955344D0E353012ABDCB4AF4E836515531B1BEF4C2FA5A07EC5B41A9CD74C68E39B977E43F9AD1A06AC32FA27E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_})E>.zE>.zE>.zLF.zC>.z.Q.{G>.z.Q.{O>.z.Q.{F>.z.Q.{R>.zQU.{M>.z.N.{B>.zE>.z.?.z.N.{C>.z.N.{D>.z.N.zD>.z.N.{D>.zRichE>.z........PE..L...H._...........!.....N........../S.......`...............................0......4.....@......................... ...................X.......................8....r..T....................s.......r..@............`..`............................text....L.......N.................. ..`.rdata...r...`...t...R..............@..@.data...............................@....qtmetadm...........................@..P.rsrc...X...........................@..@.reloc..8...........................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtbase_ar.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):160017
                                                                                                                                                                                                                      Entropy (8bit):5.35627970915292
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:XGlAMfkX1M0RdaCkR8lfv8vtc8EFrVYA2I4AJZWEWgHg1C8COvzHKHC6Jp9NV0V7:XUr0RACkIwDEpV1Lgf1ubtw3Bb
                                                                                                                                                                                                                      MD5:A7E4D0BA0FC5DF07F62CC66EC9878979
                                                                                                                                                                                                                      SHA1:21FD131B23BDD1BBA7BBB86F3ED5C83876F45638
                                                                                                                                                                                                                      SHA-256:E03FE68D83201543698FD7FE267DD5DFC5BFD195147E74FF2F19AC3491401263
                                                                                                                                                                                                                      SHA-512:D9E6B10506FCF20B5B783F011908083D9DF6C5DF88E21B10D07F53A01AD6506A4B921C85335A25BAE54E27BAD7D01B6E240D58FDEEAABC7FF32014EC120C2ECF
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......arB..2....*.......+.......@.......A.......B..._...C......D.......E......F.......G... ...H...D...I...h...P...C...Q...g...R......S.......T.......U.......V...x...W......X.......Y.......]..'=...s......t...........]...........;..'....;..(....;.......;.......M..'e...O.......O...9...........}..'........C...=......m..'....t..........!o..(5...Z..+;..5u..+;..c...+O......1...!...D@...8..E@.....H4...,..HY..QI..H.......IC......J....1..J.......J.......LD......L.......PS......QR...R..R...V2..T.......U....]..X.......Zr.....[`......\....t..]x......_......._.......yg......1...6....E..8V..............C............................$..RN...[...0...,.......y.......y...................K...........9..R....E.."............z.......................%..F;...D...[..................................!....5.......0...I...0.......0...5...0..#....5.......5...p..............W}.. D..(... D..P=..+.......<U......<U......<.......H5..(...H5..P...L.......VE......VE......V....B..f...JJ..f.......f.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtbase_bg.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):165337
                                                                                                                                                                                                                      Entropy (8bit):5.332219158085151
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:9ULiyUxPoT6qx+J7FJlaaMJnxjqxq+0Uiff0mbVeb7wiEwYuYqDKBkKHMXHCIMll:9ULpIVFnpwUiEujw27ncUQUz
                                                                                                                                                                                                                      MD5:660413AD666A6B31A1ACF8F216781D6E
                                                                                                                                                                                                                      SHA1:654409CDF3F551555957D3DBCF8D6A0D8F03A6C5
                                                                                                                                                                                                                      SHA-256:E448AC9E3F16C29EB27AF3012EFE21052DAA78FABFB34CD6DFF2F69EE3BD3CDB
                                                                                                                                                                                                                      SHA-512:C6AE4B784C3D302D7EC6B9CE7B27DDAF00713ADF233F1246CD0475697A59C84D6A86BAA1005283B1F89FCC0835FD131E5CF07B3534B66A0A0AA6AC6356006B8F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......bg_BGB../....*..,....+..."...@...]...A.......B.......C.......D...P...E...!...F.......G.......H.......I.......P.......Q.......R...A...S...e...T.......U.......V.......W...1...X...U...Y...y...]..,....s...,...t...................P...;..+....;..-E...;..!....;..+....M..,Y...O...,...O...........*...}..,............=...Q...m..,....t...|......>...(5..1...+;..<...+;..o...+O...r..1...>...D@......E@......H4......HY..[...H.......IC......J....E..J....X..J.......LD......L....L..PS......QR.."...R...`...T....X..U.......X.......Zr...q..[`...`..\.......]x......_......._....T..yg.....1...=....E..?...............L(.......(...............'...$..\....[.......,...I...y...!...y...................S...........9..]%...E..5p...........z..!q...................%..O....D..................D.....8......:......?....5...&...0.......0.. ....0...c...0..5....5.......5..................b:.. D..-... D..Z...+.......<U......<U...0..<.......H5..-...H5..[...L.......VE..#a..VE..;...V.......f...T...f...!..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtbase_ca.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):210159
                                                                                                                                                                                                                      Entropy (8bit):4.666388181115542
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:P/DVhdlafzvZfeW+6kXEVjSVPzC3ceKdP2:xYf7UW+WjwP2
                                                                                                                                                                                                                      MD5:B383F6D4B9EEA51C065E73ECB95BBD23
                                                                                                                                                                                                                      SHA1:DD6C2C4B4888B0D14CEBFC86F471D0FC9B07FE42
                                                                                                                                                                                                                      SHA-256:52E94FCC9490889B55812C5433D009B44BDC2DC3170EB55B1AF444EF4AAE1D7F
                                                                                                                                                                                                                      SHA-512:9401940A170E22CE6515E3C1453C563D93869A3C3686C859491A1F8795520B61BF3F0BFE4687A7380C0CC0C75E25559354FDB5CEF916AF4C5B6CD9661464A54A
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......caB..7....*.......+.../...@..:P...A..:t...B..:....C..:....D..;=...E..<....F..<Z...G..<~...H..<....I..<....P..>....Q..>....R..?....S..?R...T..?v...U..?....V..?....W..@....X..@<...Y..@`...]../....s..1....t..........2s......#p...;.......;../....;..W....;..e+...M../3...O.......O..9.......J....}../]......8....=..9....m../....t..9Y.......S..(5..lB..+;.._...+;...=..+O..U...1.......D@..:...E@..?...H4...J..HY..~...H..."...IC...0..J....W..J....0..J.......LD..!...L...!f..PS..)...QR.."...R.......T...9~..U...9...U...z...X...>...Zr..E...[`...e..\...LD..]x..7U.._......._...M...yg..f...1...a....E..c....7.........U.......p........b.......4.......K...$.......[.......,.......y.......y...................^...........9...:...E...s...... (...z..":.......d......!....%..tQ...D.."......."......2......ve.....y...........5..#H...0...\...0..W+...0..';...0.......5..(....5..........)s.......... D..0w.. D..}...+...1...<?..5x..<U......<U..5...<...6@..H5..0...H5..~...L...9...VE..$...V...SV..f.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtbase_cs.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):174701
                                                                                                                                                                                                                      Entropy (8bit):4.87192387061682
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:5WjuhX0CVRaakGjW9E8SSOQfX/JlwVOMxrboRPqWxXfQvO7zjBf:5iFGj1QfXr8Gd
                                                                                                                                                                                                                      MD5:C57D0DE9D8458A5BEB2114E47B0FDE47
                                                                                                                                                                                                                      SHA1:3A0E777539C51BB65EE76B8E1D8DCE4386CBC886
                                                                                                                                                                                                                      SHA-256:03028B42DF5479270371E4C3BDC7DF2F56CBBE6DDA956A2864AC6F6415861FE8
                                                                                                                                                                                                                      SHA-512:F7970C132064407752C3D42705376FE04FACAFD2CFE1021E615182555F7BA82E7970EDF5D14359F9D5CA69D4D570AA9DDC46D48CE787CFF13D305341A3E4AF79
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......cs_CZB..3p...*..F....+.......@..!....@..Ef...A..!....A..E....B.."1...B..E....C.."U...C..E....D.."....D..F....E..#p...E..F)...F..#....F..FP...G..#....G..Fw...H..$....H..F....I..$6...I..F....P..&%...P..Gr...Q..&I...Q..G....R..&....R..G....S..&....S..H....T..&....T..H8...U..'....U..H_...V..'Z...V..H....W..'~...W..H....X..'....X..H....Y..'....Y..H....]..,....]..,....s.......t...9...............*...;.......;..+....;..1B...;......;..?x...;..N....;..iY...;..s3...M..,B...M..,....O.......O...w...O..rr...........}..,j...}..-....... 5...=.. ....m..,....m..-8...t.. .......ay..(5..TT..+;...A..+;..B...+;..u...+O......+O..=a..1...a...D@.."...E@..&m..E@..G...F...J...H4...=..HY..`...H.......I...J...IC......J....-..J.......J.......LD......L....(..PS.....QR.."S..R...e...T.... ..U......X.......Zr...g..[`......\......]x......_......._......._...v...yg......1...C....E..E...............=.......Q........................s...$..a....[.......,.......y.......y...y..............G..........

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtbase_da.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):181387
                                                                                                                                                                                                                      Entropy (8bit):4.755193800761075
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:XzswP2UvZ5aZ9jFTkmq/gnBNW/+PcWrqm2Vliz0DGdaS4KSLZjwTTgwUR0toT:j3m27AjCT
                                                                                                                                                                                                                      MD5:859CE522A233AF31ED8D32822DA7755B
                                                                                                                                                                                                                      SHA1:70B19B2A6914DA7D629F577F8987553713CD5D3F
                                                                                                                                                                                                                      SHA-256:7D1E5CA3310B54D104C19BF2ABD402B38E584E87039A70E153C4A9AF74B25C22
                                                                                                                                                                                                                      SHA-512:F9FAA5A19C2FD99CCD03151B7BE5DDA613E9C69678C028CDF678ADB176C23C7DE9EB846CF915BC3CC67ABD5D62D9CD483A5F47A57D5E6BB2F2053563D62E1EF5
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......daB..4....*..h....+......@...f...A.......B.......C.......D...U...E.......F...v...G.......H.......I.......P.......Q.......R...6...S...Z...T...~...U.......V.......W..."...X...F...Y...j...]..+....s.......t..................-...;..+....;..,....;../....;..;....M..+....O.......O...r...........}..,............=...8...m..,0...t...c......T...(5..B...+;..NH..+;..~H..+O..,...1...UP..D@......E@......H4...E..HY..j...H.......IC...#..J....J..J.......J.......LD......L....1..PS...B..QR......R...o...T.......U.......X.......Zr......[`...W..\....}..]x...[.._....-.._.......yg...e..1...O....E..R....7..........-!......]............................$..k....[...7...,.......y...c...y.................j4...........9..l8...E..p............z...;..................%..a....D...~.............-.....L......OH.....Uz...5.......0.......0...U...0.......0..p....5...7...5..L$..............p... D..-... D..i...+....@..<U.....<U.....<....S..H5..-2..H5..j$..L....B..VE.. ...VE..P...V...*...f...e...f.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtbase_de.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):220467
                                                                                                                                                                                                                      Entropy (8bit):4.626295310482312
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:7w8go8+ph6JVB8XVXYWpSNEeg8+vaD+p4N8DDiEKugwGZulh15ce4M+4NsPYXCZW:88h8Sj286tTiDD
                                                                                                                                                                                                                      MD5:40760A3456C9C8ABE6EA90336AF5DA01
                                                                                                                                                                                                                      SHA1:B249AA1CBF8C2636CE57EB4932D53492E4CE36AC
                                                                                                                                                                                                                      SHA-256:553C046835DB9ADEF15954FA9A576625366BA8BFD16637038C4BCD28E5EBACE1
                                                                                                                                                                                                                      SHA-512:068E55F39B5250CC937E4B2BD627873132D201D351B9351BE703CD9B95D3BAFB4BD649CB4DF120A976D7C156DA679758D952CAC5E0523107244E517D323BC0C5
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......de_DEB..7....*.......+..3....@..R....A..R....B..S....C..S@...D..S....E..T]...F..T....G..T....H..T....I..U#...P..W....Q..W6...R..W....S..W....T..W....U..W....V..XG...W..Xk...X..X....Y..X....]..2%...s..J$...t..9R......J.......B....;..1....;..3....;..q....;.......M..2O...O.......O..X@......ia...}..2y......Q....=..Q....m..2....t..Q...........(5......+;..ev..+;......+O..oh..1....4..D@..R...E@..WZ..H4..4...HY...[..H...AY..IC..>o..J...>...J.......J...>6..LD..@A..L...@...PS..I...QR..#...R....h..T...W...U...Xh..U....~..X...]...Zr..e(..[`..)...\...j...]x..O..._....K.._...lI..yg...U..1...f....E..i....7..........o.......wG......6.......6.......8....$...n...[..8....,..9....y.......y..=................3......>....9.......E..."......?_...z..#d.......0......A%...%..z....D..A.......B......KP......2.............^...5..B....0.......0..p....0..F....0...}...5..G....5..........H........... D..3}.. D...O..+...Q...<?..Ti..<U......<U..T...<...U)..H5..3...H5......L...X...VE..%j..V...l..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtbase_en.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                      Entropy (8bit):4.0
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3:j2wZC4n:CwZ
                                                                                                                                                                                                                      MD5:BCEBCF42735C6849BDECBB77451021DD
                                                                                                                                                                                                                      SHA1:4884FD9AF6890647B7AF1AEFA57F38CCA49AD899
                                                                                                                                                                                                                      SHA-256:9959B510B15D18937848AD13007E30459D2E993C67E564BADBFC18F935695C85
                                                                                                                                                                                                                      SHA-512:F951B511FFB1A6B94B1BCAE9DF26B41B2FF829560583D7C83E70279D1B5304BDE299B3679D863CAD6BB79D0BEDA524FC195B7F054ECF11D2090037526B451B78
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`...

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtbase_es.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):165170
                                                                                                                                                                                                                      Entropy (8bit):4.679910767547088
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:JVwzuvb+Ta64KQd84arHX5pxiVhA8QlOD/BnFNa8NsvsfFsfcoZtIx6F:JVwSTG4KqVaLX5pEVK7OJFczstgRtIx8
                                                                                                                                                                                                                      MD5:C7C58A6D683797BFDD3EF676A37E2A40
                                                                                                                                                                                                                      SHA1:809E580CDBF2FFDA10C77F8BE9BAC081978C102B
                                                                                                                                                                                                                      SHA-256:4FFDA56BA3BB5414AB0482D1DDE64A6F226E3488F6B7F3F11A150E01F53FA4C8
                                                                                                                                                                                                                      SHA-512:C5AED1A1AA13B8E794C83739B7FDDEAFD96785655C287993469F39607C8B9B0D2D8D222ECD1C13CF8445E623B195192F64DE373A8FB6FE43743BAF50E153CDA5
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......es_ESB../....*..*,...+...y...@.......A.......B.......C.......D...v...E...=...F.......G.......H.......I.......P.......Q... ...R...k...S.......T.......U.......V...1...W...U...X...y...Y.......]..+....s.......t...................c...;..+....;..,....;...%...;..#....;..-....M..+....O.......O...............}..,............=...]...m..,/...t..........A...(5..3...+;..<...+;..o...+O..!b..1...Ap..D@......E@...D..H4...-..HY..[F..H.......IC...%..J....L..J.......J.......LD......L....O..PS......QR..!...R...`K..T.......U....&..X.......Zr.....[`...h..\......]x...|.._....Y.._....A..yg......1...=....E..?a......!.......K........G...............R...$..\Q...[.......,...z...y.......y..................+............9..\....E..2............z.. ....................%..ON...D........................:......=B.....A....5...7...0.......0......0.."....0...,...0..3....5...}...5...Y..............a... D..-!.. D..Z6..+....0..<U...h..<U......<.......H5..-M..H5..Z...L.......VE.."...VE..>...V......

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtbase_fi.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):179941
                                                                                                                                                                                                                      Entropy (8bit):4.720938209922096
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:lvdTgO2Yl97ZWnbgTLt/Tf9IlqAeiy5uWkYGM0wNCdRjSK2YUlUs:lvdkA9vh5uWkY0MK2YXs
                                                                                                                                                                                                                      MD5:8472CF0BF6C659177AD45AA9E3A3247C
                                                                                                                                                                                                                      SHA1:7B5313CDA126BB7863001499FB66FB1B56C255FC
                                                                                                                                                                                                                      SHA-256:E47FE13713E184D07FA4495DDE0C589B0E8F562E91574A3558A9363443A4FA72
                                                                                                                                                                                                                      SHA-512:DE36A1F033BD7A4D6475681EDC93CC7B0B5DCB6A7051831F2EE6F397C971B843E1C10B66C4FB2EFF2A23DC07433E80FBF7B95E62C5B93E121AB5AD88354D9CB8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......fiB..38...*..ct...+......@.......A.......B.......C...@...D.......E...]...F.......G.......H.......I...#...P.......Q...6...R.......S.......T.......U.......V...G...W...k...X.......Y.......]..*....s...T...t.......................;..*....;..+....;..&....;..3....M..+!...O.......O...e...........}..+K...........=.......m..+w...t..........J...(5..9...+;..:y..+;..mW..+O..$...1...KY..D@......E@...Z..H4...l..HY..X&..H.......IC......J.......J...."..J......LD.....L.......PS...'..QR.. L..R...]...T.......U.......X.......Zr......[`......\.......]x......_....k.._....>..yg.. /..1...;....E..>....7..{(......%.......J........T.......&.......U...$..Y[...[......,...s...y.......y...a.......}......d...........9..Y....E..k'...........z...........V..........%..M....D...Q.......{......d.....A......E......K....5.......0.......0..&J...0.......0..k....5...*...5..I9.............._:.. D..,O.. D..W...+....9..<U...G..<U...*..<.......H5..,y..H5..W...H5......L....5..VE..!u..VE..E...V..."{..f.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtbase_fr.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):166167
                                                                                                                                                                                                                      Entropy (8bit):4.685212271435657
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:CLZ1w8McowCppcPwL5pYFw+G00QsbLckCiWxvq+sjs06oFm:C91wxcowspc4L5pUw+cz39CiQ7tloFm
                                                                                                                                                                                                                      MD5:1F41FF5D3A781908A481C07B35998729
                                                                                                                                                                                                                      SHA1:ECF3B3156FFE14569ECDF805CF3BE12F29681261
                                                                                                                                                                                                                      SHA-256:EDB32A933CEF376A2636634E14E2977CED6284E4AA9A4AC7E2292F9CA54C384A
                                                                                                                                                                                                                      SHA-512:A492E8AC88095A38A13549C18C68E1F61C7054AB9362C2B04C65B93E48E4A07941C8DA6950BAE79041094623E0ED330CA975110FDE8248B4D9380B9F729AD891
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......fr_FRB../....*..-....+.......@.......A.......B.......C...?...D.......E...\...F.......G.......H.......I..."...P.......Q...5...R.......S.......T.......U.......V...F...W...j...X.......Y.......]..+....s...=...t.......................;..+....;..,....;.......;..$b...;.......M..,....O.......O...5...........}..,3...........=.......m..,]...t..........A...(5..5j..+;..<T..+;..o...+O.."+..1...B\..D@......E@...Y..H4...8..HY..[{..H.......IC......J.......J.......J.......LD...|..L.......PS...?..QR..!...R...`j..T.......U....[..X.......Zr.....[`...)..\......]x......_....7.._.......yg...i..1...=Q...E..?@......"Y......K............................$..\....[...^...,...'...y.......y...+.......o....../c.......Y...9..\....E..6(...........z..!................j...%..OC...D...+.......[......a.....;......>......B....5.......0.......0...m...0..#....0.......0..6....5.......5..................a... D..-Y.. D..Ze..+....]..<U...;..<U......<.......H5..-...H5..Z...L.......VE.."...VE..?...V......

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtbase_gd.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):189580
                                                                                                                                                                                                                      Entropy (8bit):4.630160941635514
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:SiaI3C87jhakhR0VGkw7ys7CskUH6y4e6IFB4xyMuhvDnJGhFaCo527arBbm07LZ:S2yGjh17yGqxTXhvQoejJd8FUjVgk
                                                                                                                                                                                                                      MD5:EB1FB93B0BE51C2AD78FC7BA2F8B9F42
                                                                                                                                                                                                                      SHA1:24F7FF809E2F11C579CD388FEA5A4C552FF8D4D0
                                                                                                                                                                                                                      SHA-256:63B439DD44139AA3AED54C2EBE03FA9BC77F22C14ED8FBA8EFF2608445BB233D
                                                                                                                                                                                                                      SHA-512:E13770AEF33B6666ED7D54E03EE20CA291D4167D673BA6C61D8E64CDD5F7FFE0A9521B95AF67BE719BF263932ECF16E2B2D0B5F3404F9BCD7879114FCC6FC474
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......gd_GBB..2....*...u...+......@.......A...B...B.......C.......D.. ....E.. ....F..!&...G..!J...H..!n...I..!....P..#m...Q..#....R..#....S..$....T..$$...U..$H...V..$....W..$....X..$....Y..%....]../....s...'...t...................F...;.......;../....;..=V...;..G....M../G...O.......O...k......$....}../o.......i...=.......m../....t..........[...(5..M...+;..@...+;..x...+O..:...1...\7..D@...f..E@..#...H4...p..HY..be..H.......IC......J.......J....R..J.......LD......L.......PS......QR..#l..R...g...T.......U.......X....\..Zr......[`......\...&...]x......_....C.._...'t..yg..?...1...BM...E..D.......;.......R'.......t.......@.......?...$..c....[......,...i...y.......y...Y.......f.......+...........9..c....E...............z.."....................%..U....D..................G.....UB.....W......\]...5.......0.......0..<....0...;...0.......5.......5..ij..............h... D..0... D..aC..+....K..<U.....<U...~..<.......H5..0...H5..a...L....1..VE..$...VE..X...V...8|..f...Z...f...=..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtbase_he.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):138690
                                                                                                                                                                                                                      Entropy (8bit):5.515748942553918
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:XSue8Z7T3iJsqBejt/zNHSLzdetY2ZISfC/S:XSueK3w7Ijt8zUtYAISfC/S
                                                                                                                                                                                                                      MD5:DEAF87D45EE87794AB2DC821F250A87A
                                                                                                                                                                                                                      SHA1:DB39C6BAA443AA9BB208043EF7FB7E3403C12D90
                                                                                                                                                                                                                      SHA-256:E1EBCA16AFE8994356F81CA007FBDB9DDF865842010FE908923D873B687CAD3F
                                                                                                                                                                                                                      SHA-512:276FCE81249EFFE19E95607C39F9ACB3A4AFA3F90745DA21B737A03FEA956B079BCA958039978223FD03F75AC270EC16E46095D0C6DDA327366C948EC2D05B9C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......he_ILB../....*......+..Sw...@......A......B.......C.......D...X...E.......F.../...G...O...H...o...I......P.......Q.......R...I...S...i...T......U......V.......W.......X.../...Y...O...]..$....s......t..X:.......4......`Y...;..$....;..%....;.......;...5...;.......M..$....O...6...O..s............}..%-...........=...m...m..%k...t..........^..(5......+;..2...+;..^...+O...N..1.......D@......E@...(..H4..T...HY..L...H..._...IC..\...J...\...J.......J...\j..LD..^...L...^o..PS..fl..QR......R...Q...T...su..U...s...X...x3..Zr..~...[`..L\..\.......]x....._......._....o..yg...(..1...3....E..5C.......z......?V......U.......U.......W....$..M....[..W....,..X....y.......y..\........a..............\@...9..NO...E...?......]s...z...G.......(......^....%..B^...D.._......._.................... ..........5..`/...0.......0...L...0......0..d(...0......5..ek...5..........fB......R... D..&O.. D..K...+...l...<U......<U..p)..<...p...H5..&w..H5..La..L...s...VE......VE......V.....

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtbase_hu.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):160494
                                                                                                                                                                                                                      Entropy (8bit):4.831791320613137
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:BmOMZadV9n51xXeQvjOiIzz7/Vs9Db3ihuJNvMfWxBNlYzYbTrIkfwb03l24cNKu:HkWa5pg0MahBHDd
                                                                                                                                                                                                                      MD5:E9D302A698B9272BDA41D6DE1D8313FB
                                                                                                                                                                                                                      SHA1:BBF35C04177CF290B43F7D2533BE44A15D929D02
                                                                                                                                                                                                                      SHA-256:C61B67BB9D1E84F0AB0792B6518FE055414A68E44D0C7BC7C862773800FA8299
                                                                                                                                                                                                                      SHA-512:12947B306874CF93ABA64BB46FAC48179C2D055E770D41AF32E50FFFB9F0C092F583AFCEA8B53FE9E238EF9370E9FFFBEB581270DFA1A7CB74EBE54D9BFF459F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......hu_HUB../....*.......+.......@.......A...0...B...{...C.......D.......E.......F.......G...<...H...`...I.......P...s...Q.......R.......S.......T...*...U...N...V.......W.......X.......Y.......]..+y...s.......t.......................;..+Q...;..,U...;.......;.......;..&....M..+....O.......O...U..........}..+............=.......m..+....t..........9c..(5..,...+;..;...+;..m7..+O......1...9...D@...T..E@......H4...v..HY..Y...H.......IC......J.......J.......J.......LD......L.......PS...}..QR..!...R...]...T.......U....{..X.......Zr...=..[`......\....*..]x...-.._......._......yg...M..1...<....E..>...............J........T.......(.......S...$..Z....[.......,...u...y.......y...[...............#...........9..Z....E..#&...........z..!'...................%..Mv...D..._....................32.....5......9....5.......0...h...0...E...0.......0.......0..#....5...Z...5...........G......_2.. D..,... D..W...+....W..<U......<U...B..<.......H5..,...H5..X{..L....)..VE.."...VE..6l..V....*.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtbase_it.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):161172
                                                                                                                                                                                                                      Entropy (8bit):4.680034416311688
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:eSfxfdO4BKJb0td5pqCOIUP/PFIM7gxGQ9sRrFM6QJ4m8ihkM:eSfxFO4BKJb0td5pnOrvCqg9mRK4IkM
                                                                                                                                                                                                                      MD5:88D040696DE3D068F91E0BF000A9EC3E
                                                                                                                                                                                                                      SHA1:F978B265E50D14FDDE9693EC96E99B636997B74D
                                                                                                                                                                                                                      SHA-256:7C7DC8B45BF4E41FEC60021AB13D9C7655BE007B8123DB8D7537A119EB64A366
                                                                                                                                                                                                                      SHA-512:F042637B61C49C91043D73B113545C383BD8D9766FD4ACC21675B4FF727652D50863E72EA811553CB26DF689F692530184A6CE8FE71F9250B5A55662AFE7D923
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......it_ITB../....*.......+.......@.......A..."...B...m...C.......D.......E.......F.......G...0...H...T...I...x...P...q...Q.......R.......S.......T...(...U...L...V.......W.......X.......Y.......]..+....s...'...t...................^...;..+[...;..,g...;.......;.......;..!B...M..+....O...D...O...........(...}..+........I...=.......m..,....t..........4...(5..'...+;..<...+;..oV..+O......1...5...D@...F..E@......H4...J..HY..Z...H.......IC...L..J....s..J....j..J.......LD......L....f..PS......QR..!...R..._...T.......U....3..X.......Zr......[`...Q..\.......]x......_......._....0..yg...C..1...=....E..?o..............Kf.......h.......8.......I...$..[....[.......,...m...y...9...y...........z.......z...........9..\=...E..$u.......:...z.. k...................%..N....D..................M............0......5/...5...2...0.......0...0...0...A...0...)...0..$....5.......5...J.......a......a... D..,... D..Y...+.......<U......<U......<....v..H5..-...H5..Z...L.......VE.."c..VE..1...V....X.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtbase_ja.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):129911
                                                                                                                                                                                                                      Entropy (8bit):5.802855391832282
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:W8YYSCjKBJ26c1Z7f25pVmuLXpxfqt7FEUWNrfQje9kWI23pKXvx:xYuKBJ01Z7u5pQuLbESUWNzAAI23pKfx
                                                                                                                                                                                                                      MD5:608B80932119D86503CDDCB1CA7F98BA
                                                                                                                                                                                                                      SHA1:7F440399ABA23120F40F6F4FCAE966D621A1CC67
                                                                                                                                                                                                                      SHA-256:CBA382ACC44D3680D400F2C625DE93D0C4BD72A90102769EDFD1FE91CB9B617B
                                                                                                                                                                                                                      SHA-512:424618011A7C06748AADFC2295109D2D916289C81B01C669DA4991499B207B781604A03259C546739A3A6CF2F8F6DFA753B23406B2E2812F5407AEE343B5CBDD
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......jaB../....*...'...+..=....@.......A.......B...?...C...c...D......E......F.......G.......H..."...I...F...P.......Q...'...R...r...S......T......U.......V...8...W...\...X......Y......].."k...s...Q...t..A...............I....;.."C...;..#A...;.......;.......;.......M.."....O...B...O..[?......h....}.."........m...=.......m.."....t...........M..(5......+;......+;..WU..+O......1.......D@......E@...K..H4..>=..HY..F...H...Hr..IC..E...J...F...J.......J...E...LD..Gz..L...G...PS..O...QR......R...K!..T...Z...U...[e..X..._f..Zr..e...[`..7...\...i...]x...'.._......._...j...yg..~+..1.../....E..1?.......#......:.......?.......?n......A....$..G....[..Ap...,..B....y.......y..Ew......|...............E....9..H....E..........F....z...]..............HL...%..=R...D..H.......I!......[......J......M..........5..It...0...3...0.......0...C...0..M....0...a...5..N....5..........N.......L6.. D..#... D..E...+...U%..<U......<U..X ..<...X...H5..#...H5..FK..L...[...VE......VE......V......f.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtbase_ko.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):156799
                                                                                                                                                                                                                      Entropy (8bit):5.859529082176036
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:rvTy18hhPekHs1iNXVExWbStnn8TExgkYOvYejZOvXx4Mmf0MwUL8smk/pDZyy:y18hJ61nMStnn8TOgknQRLWZmkxNyy
                                                                                                                                                                                                                      MD5:082E361CBAC2E3A0849F87B76EF6E121
                                                                                                                                                                                                                      SHA1:F10E882762DCD2E60041BDD6CC57598FC3DF4343
                                                                                                                                                                                                                      SHA-256:0179ED1B136E1CB3F583351EAA2C545BA3D83A6EE3F82C32505926A1A5F5F183
                                                                                                                                                                                                                      SHA-512:F378A42116924E30FA0B8FFF1D3C3CB185DC35B2746DCE2818BE7C2AA95C5DE103DF44AAC74DA969C36C557F1D4DE42AC7647EC41066247F8AD2697BDED667EA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......koB..7....*.......+.......@...K...A...o...B......C.......D...8...E.......F...U...G...y...H......I.......P......Q.......R.......S...C...T...g...U.......V.......W.......X...-...Y...Q...]..$....s...>...t...................y...;..${...;..%....;...u...;...l...M..$....O.......O...8...........}..$............=...C...m..%!...t...n..........(5...a..+;..E@..+;..l|..+O......1.......D@.....E@......H4......HY..\...H....]..IC......J.......J....8..J.......LD...a..L.......PS......QR......R...`...T.......U....^..U.......X....y..Zr......[`..y...\....A..]x......_......._....o..yg......1...FJ...E..HE...7..................Q........a.......5...........$..]....[...;...,.......y.......y...V...............!.......|...9..]....E...R...........z...4.......f.......5...%..Te...D..................D......^.............*...5...S...0.......0.......0.......0.......5.......5...........n......a... D..%... D..[...+.......<?......<U...;..<U...+..<.......H5..&...H5..\...L.......VE......V....A..f.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtbase_lv.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):153608
                                                                                                                                                                                                                      Entropy (8bit):4.843805801051326
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:y5pmbKIhooMbGe91MrjOhmGzP6LJbWz5XIxELpU6:yObeqrjPGzeJyJLy6
                                                                                                                                                                                                                      MD5:BD8BDC7BBDB7A80C56DCB61B1108961D
                                                                                                                                                                                                                      SHA1:9538C4D8BB9A95C0D9DC57C7708A99DD53A32D1F
                                                                                                                                                                                                                      SHA-256:846E047573AE40C83671C3BA7F73E27EFC24B98C82701DA0DF9973E574178BB2
                                                                                                                                                                                                                      SHA-512:F040EC410EBFEA21145F944E71ADCAE8E5F60907D1D3716A937A9A59A48F70C6B7EAAC91C2C554F59357A7BC820CDBD17C73A4DECC20B51F68EB79EDD35C5554
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......lv_LVB.......*...B...+..y....@.......A...=...B......C......D.......E.......F...#...G...G...H...k...I.......P...~...Q......R.......S.......T...5...U...Y...V......W.......X.......Y.......]..%....s.......t...8.......n.......A...;..&....;.......;...!...;...A...;../....M..%....O.......O...............}..%...........=.......m..&....t...(......(g..(5...+..+;..4...+;..d...+O......1...(...D@...a..E@......H4..z...HY..Q...H.......IC......J....6..J.......J.......LD......L....9..PS......QR......R...U...T....S..U.......X...._..Zr......[`..r...\.......]x...*.._......._....{..yg......1...5v...E..7........(......B.......|.......|W......~r...$..R....[..~....,.......y...l...y...............................9..S....E...g...........z...z...................%..F....D........................"Z.....$......)....5.......0...\...0.......0...r...0.......0.......5...a...5..........J......V... D..&... D..P...+.......<U......<U......<.......H5..'"..H5..P...L....~..VE...R..VE..%...V......

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtbase_pl.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):162982
                                                                                                                                                                                                                      Entropy (8bit):4.841899887077422
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:sXpestp/YIFtDT8FIWYbIJmPYuIpnmxAk6mwyJNqSm9+P:sxpTDT8FIWfJmdCmxApmbnqSm9+P
                                                                                                                                                                                                                      MD5:F9475A909A0BAF4B6B7A1937D58293C3
                                                                                                                                                                                                                      SHA1:76B97225A11DD1F77CAC6EF144812F91BD8734BD
                                                                                                                                                                                                                      SHA-256:CE99032A3B0BF8ABAD758895CC22837088EAD99FD2D2514E2D180693081CFE57
                                                                                                                                                                                                                      SHA-512:8A4F1B802B6B81FF25C44251FB4A880E93E9A5FE25E36825A24BFE0EFB34E764E7E1EE585D3A56554964B7921E7813C67F12D200D6E0C5EAF4BB76B064B5C890
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......pl_PLB..0....*.."....+.......@...F...A...j...B......C.......D...3...E.......F...P...G...t...H.......I.......P.......Q.......R.......S...>...T...b...U.......V.......W.......X...(...Y...L...]..*....s.......t...r.......o.......+...;..*....;..+....;..."...;... ...M..*....O...6...O...........a...}..+...........=.......m..+G...t...G......,...(5......+;..:...+;..k...+O......1...-[..D@.....E@......H4...U..HY..WU..H.......IC......J....6..J.......J.......LD......L....%..PS......QR.. ...R...[...T....1..U.......X......Zr......[`......\.......]x...A.._......._....}..yg......1...;W...E..=........%......H....................$..Xp...[.......,.......y...i...y...........}......$R...........9..X....E..+)...........z.. E...................%..K....D...p....................&......(......-....5.......0.......0...e...0.......0..+....5...]...5...........f......]-.. D..,%.. D..V?..+....V..<U......<U......<....-..H5..,M..H5..V...L....Z..VE..!...VE..)...V.......f...P...f....K..f......

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtbase_ru.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):203767
                                                                                                                                                                                                                      Entropy (8bit):5.362551648909705
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:hn4dEJ63pdhPpy6gu5fs4MHQv6sLlxnrncF423ZL9xyuXwdcX8LZuf76CW+WeXFx:aN3pdV5fZbpItXsttRY+WSq
                                                                                                                                                                                                                      MD5:5096AD2743BF89A334FBA6A2964300D4
                                                                                                                                                                                                                      SHA1:405F45361A537C7923C240D51B0FF1C46621C203
                                                                                                                                                                                                                      SHA-256:3DA6605668F9178D11A838C4515478084DCFB4F9CF22F99D7A92B492DB9C224B
                                                                                                                                                                                                                      SHA-512:7B88B501792B5831426BAA669138192ED94CC3F8323A3DF9D5287655DC4D877706908C517AB7523AE8A283BF50B47123F13B8AE40EA2F3081C3459EDC47FC8DD
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......ru_RUB..7....*...L...+...W...@..,....A..,....B..-1...C..-U...D..-....E...r...F.......G.......H../....I../8...P..1'...Q..1K...R..1....S..1....T..1....U..2....V..2\...W..2....X..2....Y..2....].......s..$c...t...'......%........r...;..-....;.......;..J....;..V....M...C...O.......O..&.......8....}...m......+3...=..+....m.......t..+.......p...(5..]@..+;..[0..+;......+O..H...1...qM..D@..-...E@..1o..H4...p..HY..xm..H....*..IC...@..J....g..J.......J.......LD......L....p..PS......QR..!...R...}...T...&...U...'...U...ki..X...+...Zr..3...[`......\...:...]x..)..._......._...;...yg..S...1...\....E..__...7.........H.......k................j.......U...$..y....[.......,.......y...k...y...............................9..y....E...O...........z..!*...................%..nW...D.................%w.....g......j~.....qw...5...H...0.......0..I....0..._...0......5.......5..................~... D../k.. D..wa..+....?..<?.."t..<U......<U.."...<...#z..H5../...H5..w...L...&...VE.."...V...F$.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtbase_sk.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):125763
                                                                                                                                                                                                                      Entropy (8bit):4.80343609423322
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:roXDuC1u/2lUBGjJirE5tsd/aev1GIfOdvhw:OucMGjH5tbm
                                                                                                                                                                                                                      MD5:3D60E50DCBCBD70EE699BC9B1524FCB9
                                                                                                                                                                                                                      SHA1:0211B4911B5B74CC1A46C0FCA87D3BF5632AA44A
                                                                                                                                                                                                                      SHA-256:D586AE2C314074CF398417FDECB40709D5478DFEB0A67C2FE60D509EE9B59ED7
                                                                                                                                                                                                                      SHA-512:F98211867F1DBCB8A342C00E23FA5718BE6E999F7449CB8470B41BF0F527C7F78CC4D6666E28968F32E96026907156753979BFADA7E6BF4225D02A902D24906D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......sk_SKB..$x...*.......+..>....@......A......B.......C.......D...3...E...Z...F......G......H.......I.......P.......Q...D...R.......S......T.......U.......V...1...W...X...X.......Y......]...Y...t..D-......K....;...3...;.......;.......;......;...V...M.......O.._ ......l....}.......m...........T..(5...(..+;......+;..%...+O......1......E@...k..F.......H4..?I..HY..@7..H...J...I....,..IC..HT..J...H{..J...H...LD..J"..L...Jv..PS..Q...R...D...Zr..i]..[`..7...\...nB.._...o...1...&....E..(........B......19......A.......A....$..AF...[..C....,..D....y..G.......v........g......G....9..A....E..........IH...%..4.......Kf..............................5..K....0...,...0.......0.......0..Of...0.......5..P....5..........E... D...C.. D..?'..+...Y`..<U......<U..\...<...]...H5...m..H5..?...L...^...VE......f.......f...8...g.......l...aP.......................6......d....D..f(...`..f...............?....`..h5...y..H....5..j........E...e.......e..@....... ......>......oZ......l..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtbase_tr.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):194487
                                                                                                                                                                                                                      Entropy (8bit):4.877239354585035
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:yRRhAFCvqDBitD/iDG9AOH+l4TcwZBPqHo9fd9CFRK+2IKAimxsjucV2p0ZqvRu7:yRRHs5mksWVX3lA3
                                                                                                                                                                                                                      MD5:6CBC5D8E1EABEC96C281065ECC51E35E
                                                                                                                                                                                                                      SHA1:4E1E6BA3772428227CB033747006B4887E5D9AD1
                                                                                                                                                                                                                      SHA-256:6A0BF6E70E7920C2B193E76E92F78F315936955D3B06AC039D917F2E06C43281
                                                                                                                                                                                                                      SHA-512:CE1F9EE180176153D5F523D71E0DB06F4DEA65C24E5E2CD56341CFAEE349A8E9A0F606D99F7219A35DD4516D1528C90AEA4BB87548A55392B8F2B36164D478B1
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......tr_TRB..7....*.......+...-...@.......A.......B.......C...%...D.......E...F...F.......G.......H.......I.......P.. ....Q.. ....R..!D...S..!h...T..!....U..!....V.."....W.."0...X.."T...Y.."x...]..,g...s.../...t......................;..,9...;..-I...;..9@...;..E....M..,....O.......O...G...........}..,............=...\...m..,....t.........._3..(5..LJ..+;..Wt..+;...\..+O..7...1..._...D@......E@..!...H4...@..HY..t...H....2..IC...r..J......J....D..J....K..LD...$..L....x..PS......QR..!...R...x...T.......U....q..U...Y...X...."..Zr...%..[`......\....:..]x......_......._.......yg..6...1...X....E..[....7...Z......7Q......f............................$..u....[...:...,...5...y.......y...........7...............!...9..u....E...........P...z.. ........p...........%..j....D..................A.....U......Y......_....5...V...0.......0..8....0...U...0.......5.......5..~b..............z+.. D..-... D..s...+.......<?...8..<U...s..<U...p..<.......H5..-...H5..s...L.......VE.."0..V...4..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtbase_uk.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):158274
                                                                                                                                                                                                                      Entropy (8bit):5.402056706327934
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:jXwjFVUDdMUD4TzdAhpQgO5poZHvJllEnhmdK4I77/dnPJX/imfb1jhvv3BxT8ue:jBzD4Tzaw5pCvJ8hVPdlvj3p8
                                                                                                                                                                                                                      MD5:D6234E4E21021102B021744D5FA22346
                                                                                                                                                                                                                      SHA1:63A14327D0CF0941D6D6B58BFA7E8B10337F557B
                                                                                                                                                                                                                      SHA-256:51B8FF55B37DC5907D637A8DDDA12FBE816852B0244C74EB4F0FB84867A786E0
                                                                                                                                                                                                                      SHA-512:37D24A092C5F29BACB7A4CA8207C4EEFD0F073B7E74A492402867F758084091BF1D79D2BA2B4A28B35FEF42E8023C371FDE97578F74BB2033551154E77102DE6
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......uk_UAB../....*...E...+...l...@.......A.......B...G...C...k...D.......E.......F.......G.......H...*...I...N...P...=...Q...a...R.......S.......T.......U.......V...r...W.......X.......Y.......]..*y...s.......t...........;.......n...;..*Q...;..+U...;.......;...x...;..!(...M..*....O.......O...........6...}..*........E...=.......m..*....t..........3...(5..&...+;..:...+;..k0..+O...A..1...4-..D@... ..E@......H4...8..HY..W...H....2..IC...V..J....}..J.......J....%..LD...&..L....z..PS......QR.. ...R...\...T....(..U.......X.......Zr......[`..~...\.......]x......_......._....4..yg...c..1...;....E..=w.......m......I............................$..X....[...<...,.......y.......y...........M...................9..Y....E...F.......D...z.. ........P...........%..LB...D.......................-n...../......4W...5...F...0...p...0...W...0.......0...k...0.......5.......5..................^... D..+... D..V...+.......<U.../..<U......<....>..H5..+...H5..V...L....S..VE..!...VE..0...V......

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtbase_zh_TW.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):127849
                                                                                                                                                                                                                      Entropy (8bit):5.83455389078597
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:Fv2cHP10gOs6dcFxsJopMqOWv2WIrPFP8pa:Fh6s6iFxEodjef8pa
                                                                                                                                                                                                                      MD5:9C6A3721D01ECAF3F952CE96F46CE046
                                                                                                                                                                                                                      SHA1:4A944E9E31DF778F7012D8E4A66497583BFD2118
                                                                                                                                                                                                                      SHA-256:085D29EAF9BBB788B2F2503D74A1EF963A9411CEB600441254CE49A120E1AB63
                                                                                                                                                                                                                      SHA-512:6E2807B8785F42A26C9CCBDBA0327DD40B529B10C468593F0E74113774D1CCDAA4FD9ACE9B259B9040E1475911428ECAEA49425B0F170862CF8147D23DB48E46
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......zh_TWB..2x...*.......+..)....@.......A.......B...j...C......D.......E......F.......G...)...H...M...I...q...P...%...Q...I...R......S......T.......U.......V...Z...W...~...X......Y.......]..!....s.......t..-...............4....;..!z...;.."|...;.......;.......M..!....O.......O..Ay......N)...}..!............=.......m.." ...t...(.........(5......+;..;...+;.._...+O......1.......D@...C..E@...m..H4..*W..HY..Pm..H...3...IC..1...J...1...J.......J...1...LD..2...L...38..PS..6...QR...T..R...T...T...A...U...A...X...E...Zr..K...[`..$...\...OW..]x......_......._...P...yg..a^..1...<....E..>....7...>.......;......Fo......+.......+.......-L...$..QR...[..-....,...F...y.......y..1J...............6......1p...9..Q....E..........2....z...........<......3....%..H....D..4W......4}....................Z...... ...5..4....0...?...0...K...0..5....0...L...5..6....5..........6.......U... D.."... D..O...+...<%..<U......<U..>...<...?:..H5..#...H5..O...L...AS..VE...M..VE......V.......f...L..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtmultimedia_ar.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):11486
                                                                                                                                                                                                                      Entropy (8bit):5.268991075562103
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:20UQRn2sg91xzuera9bIWo6P5qIJtzi82337ui:2ri2sgj6E6P5qizPWLui
                                                                                                                                                                                                                      MD5:C0A0146E0F690E7CFFF468D9D2B23BF8
                                                                                                                                                                                                                      SHA1:4649CDF3C53E6012810F44D8A8903EE7606F4B35
                                                                                                                                                                                                                      SHA-256:5FC10414E168C1161B8590A5C173D140D31B17CF450F0AC93E666EBF7A2FF908
                                                                                                                                                                                                                      SHA-512:6AA319C3CC6CEC5F6F06BDAE653F97E6B31D49DEB012DB84EE816DE5A6FFD0DD7A1395A8D387557081D87A6D54BE31EE8083A13B6BCB030CEAF4D7247701DC22
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......arB.....X.A..#.................Q.......R.....H.W.>.........%....1..#h.C|......OY....I.c....'k..]>...k..]>...M..................t..&F................|......W.......[C......p....%...#..."....n..........!..................zn......*......:.....@.C......w\^...X.............)...TD...g..T................N.....q3....z...........U.......T..............b........1..........."...............e.........c.....I.l.E.....l.E...C.l.E..)...6...'............a..$x. ^>.........!Y...... -......>............(>.#......K.s......s....t......'...n...A....&...Z..............X5A.....q.C.....x.....9...^...G...N......L.......M..."I......B.......P.w. .....};...._...... ........)..J....|.........?.............|....(...Q5..._..KT...ri..).....6.F.3.B. .E.D.A.Q.'.*. .R.A.W. .(.(.D.'. .*.1.H.J.3.).)..........RAW (headerless) file format.....AudioContainerControl.......F.3.B. .E.D.A.Q.'.*. .W.A.V..........WAV file format.....AudioContainerControl.....0.(.J.'.F.'.*. .P.C.M. .5.H.*.J.Q.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtmultimedia_bg.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):13683
                                                                                                                                                                                                                      Entropy (8bit):5.206041252254424
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:rcVs16vrAWygoSWLyZ5aQVa3A3mMa83DB3eAsk:rcVs16vrAWyoWuZ5aQVa3A2Maq93eAsk
                                                                                                                                                                                                                      MD5:15EA6B38E1EF62ABC6AE030ED6C665DB
                                                                                                                                                                                                                      SHA1:4F541734690E100747A99D259D2DAB948BE0D68A
                                                                                                                                                                                                                      SHA-256:ADD8675FBC2351FB6C8397ED36932F98553782DD4CE0498EFC5B89B050AC8626
                                                                                                                                                                                                                      SHA-512:B34A1465E59F156F87879F83BA350AE7D632CE246C079BDE2976ED53B6DC6CDED1989CF6C80F53CA94498AD3EC8E573F0B60D21EEDAC742F81D0FF3C78634FF3
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......bgB.....X.A..+.......$.........Q.......R.......W.>...2.....-....1..+".C|....B.OY...%...]>...S..]>..!........j..........t...n.............-..|...%..W.... ..[C......p....-...#...*{...n..........)U.................zn...,..*......:....#..C....G.w\^.........%i......1y..TD......T....U...........N.....q3....<......&g...U...}...........T..............b........1...........R......$....... ........).c.......l.E.....l.E.....l.E..2...6.../\......#@...a..,^. ^>...o.....(.......'.......P............0p.#......K.s......s.........../...n............Z............@..\T.."..X5A.....q.C...j.x.........^.......N...c..L.......M...).................w. .....};....B......(........I..J..............?..........!..|....0...Q5......KT...|i..2s....@.$.0.9.;.>.2. .D.>.@.<.0.B. .R.A.W. .(.1.5.7. .7.0.3.;.0.2.:.0.)..........RAW (headerless) file format.....AudioContainerControl.....".$.0.9.;.>.2. .D.>.@.<.0.B. .W.A.V..........WAV file format.....AudioContainerControl.....2...C.4.8.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtmultimedia_ca.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):14877
                                                                                                                                                                                                                      Entropy (8bit):4.495618627792468
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:xWSMgD83O3Oesgu143Ik6f0w633EyAo3tb3Mb3y3CJ3Q3IF+P/F8NdEF3g033T3m:9M28+eesgY4npUyd9bsiSJP+Xu6Q03j2
                                                                                                                                                                                                                      MD5:F4ACB5614C77260B4C1177CDB350942E
                                                                                                                                                                                                                      SHA1:C53DA2DACF580A48D18E4BC36B513A6402147F4C
                                                                                                                                                                                                                      SHA-256:99AAE58CE729312B4ED38DB7D8AA42C770EAA4CC3F669626F9BEB9676BC21EF2
                                                                                                                                                                                                                      SHA-512:E736DD2B985F8E579598E9465C662E2D53427FC4ED05FFC1DD1580DBA485021581AD4D0700A58E971A48FF9D6455597BA486078DEDF72CEAB8B02E557FB9FA37
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......caB.....X.A../........7.Q.......Q.....2.R.....V.W.>.........1....1../..C|......OY...(..c....3...]>..!...]>..&y......................%...........t..2h.............,.......5..|...)..W....$..[C......p....1...#...._.......~...n...a..............-7.................zn......*.............:....'..C......w\^.. @.....)U......5...TD......T....Q......#J...N...g.q3............:......*]...U.."D...T..............b....[...1..................({......%U.........c.......l.E.....l.E...s.l.E..6...6...3l......'8..{4...}...a..0L. ^>.........,.......+.......`............4..#......K.s...I..s...".......47..n........2...Z..............=.......X5A.....q.C.....x.........^.......N......L....t..M...-...............Z.w. .. ..};...$.......+...........J.........../..?....g.....%..|....5`..Q5......KT...zi..6.....L.F.o.r.m.a.t. .d.e. .f.i.t.x.e.r. .R.A.W. .(.s.e.n.s.e. .c.a.p...a.l.e.r.a.)..........RAW (headerless) file format.....AudioContainerControl.....(.F.o.r.m.a.t. .d.e. .f.i

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtmultimedia_cs.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):15906
                                                                                                                                                                                                                      Entropy (8bit):4.737087172418041
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:RcPvbZYqjMvs1eEt86I3f4EwKiZU8UkFPU:RcPvbZYRvs1e76I3w+8UsPU
                                                                                                                                                                                                                      MD5:3BBF388844D5DB68FBE5EF1ABF01031A
                                                                                                                                                                                                                      SHA1:257CC6C095C67000D4DE8F832F3447E0F755905D
                                                                                                                                                                                                                      SHA-256:6F116E7A2FDEFE84A890DF1718D235E61D5731BF7C2E3E57A838F6EC9EEDE0FA
                                                                                                                                                                                                                      SHA-512:3F2328AADF5A8DFECE7DDED754CAA2C3FCC861564D135C6C1D0699AAA57A986E62B652EC41352EDC0353927A512F72844A124EAC3D8551AED794731B8B13C039
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......cs_CZB.....MJ....1.OY......X.A..6%................Q.....G.R.....s.W.>...i..D..........7...}q.......1..5..C|......OY...0Q..]>..(!..]>..-.......%.......T.Qz....m...t..8h............#...|...,@.W....+f.[C.......#...4...[E......'....t......:...n...L......3...........0$...Q..zn......*...&-..*...').:..../2.C......w\^..&......0...TD..#G..T...".......)....N...X..K....*......1....U..)!......(............T.."G....... ...1.......1.. ..6..................../.......+...........V......W......c.......l.E...,.l.E.....l.E..!...Z2.......~.......~......6...9E..........&A.......a..6....S...o. ^>...*.I}b.........3.......1.................... j..'.............#......K.s......s...)....N..........9...n........8..N........Z...............\T...-.X5A.....q.C.....x.........~...p...N......L.......M...4 .....$J.......5.w. ..'..};...*...o....h......2w..........J...._..J....J.......?.....$...?..........,...Q5..%...KT..!k..G.....i..:[....(.S.o.u.b.o.r.o.v... .f.o.r.m...t. .R.A.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtmultimedia_da.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):13659
                                                                                                                                                                                                                      Entropy (8bit):4.616849544167846
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:Xr0R2Psma1C9gNjFjOMFyp/vSR5p2h8klZBrNQ:XAR2PsmEFewyp/aR2ieZBe
                                                                                                                                                                                                                      MD5:34BB0ECE3C0DB02ED3E1E73AE1932719
                                                                                                                                                                                                                      SHA1:E23C7790CAFBA427A3E70F705B7B4CBE9F228DDF
                                                                                                                                                                                                                      SHA-256:39D902411064CC5C5FD45742F1768022A1AE7953700741B2F608E3807E19110A
                                                                                                                                                                                                                      SHA-512:9E1C462D2535D7262127AF3DF8028E27F57C3352E97EB28F6D4055516D453C9F60775283DD4A63EDD3ECB76C557F94F82988545B5016B764EE1DB8CA13AA87F0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......daB... .X.A..+.......`.........Q.......Q.....p.R.......W.>.........- ...1..+L.C|......OY...%..c..../...]>...A..]>..#........t..........................t...\.....................'..|...&p.W...."..[C......p....-...#...*............n...I..............).......*..........zn...X..*...........T.:....$..C......w\^.........&.......1?..TD......T...._...... ....N...M.q3....l.......:......'....U.......T..............b........1...........<......%E......"..........c.....i.l.E.....l.E.....l.E..1...6.../,......$0..{4...W...a..,p. ^>.........).......'.......*............0V.#......K.s...#..s... `....../...n............Z..............=.....<.X5A.....q.C.....x.....{...^...{...N...'..L.......M...*...............<.w. .....};...!y......(|..........J....x.........?.........."..|....0...Q5......KT....i..2.....2.R...t. .(.h.o.v.e.d.l...s.t.). .f.i.l.f.o.r.m.a.t..........RAW (headerless) file format.....AudioContainerControl.......W.A.V.-.f.i.l.f.o.r.m.a.t..........WAV fi

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtmultimedia_de.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):15006
                                                                                                                                                                                                                      Entropy (8bit):4.524251350180448
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:szJCssbW1tE1I2oaaVCDKEeNByOApdLowK18C3B/:sz0ssbQt3IQBNSfK+gB/
                                                                                                                                                                                                                      MD5:2EA100003233A563C03EC7B0A0C0D2ED
                                                                                                                                                                                                                      SHA1:EF56DB962FC5217A0DAB92BCC6CABB1CBE825A00
                                                                                                                                                                                                                      SHA-256:7D1541468BD09F4A34E78595DAEBDCFD7BF71715C34BF95C2DCCE41BF5484155
                                                                                                                                                                                                                      SHA-512:799271B682DAC7C9DB10B8EB3BE5237355199A30013E08C92024C68A01806710971B0A812CBFDF023F21FD2A5298F1E3F4BFF9850D5D7E357BC12CA1F7164462
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......de_DEB.....X.A..0........7.Q.......Q.......R.......W.>...B.....1....1../..C|......OY...)..c....4...]>.."S..]>..').......Z..............Y.......i...t..3V........................|...*h.W....%..[C......p....2...#.../3.......L...n..................-...............E..zn...r..*... .........:....(r.C......w\^.. ......*.......6...TD......T....;......$....N...M.q3............@......+#...U..#"...T..............b........1...........L......))......%..........c.......l.E.....l.E...y.l.E..7...6...4<......'...{4.......a..1.. ^>.........-I......+.......B............5..#....g.K.s...g..s...#.......5...n...+....3...Z....+.........=.......X5A.....q.C.....x.....C...^.......N......L.......M...................T.w. ..!..};...$.......,...........J..............?..........&U.|....5...Q5......KT...di..7[....:.R.A.W.-.D.a.t.e.i.f.o.r.m.a.t. .(.o.h.n.e. .H.e.a.d.e.r.)..........RAW (headerless) file format.....AudioContainerControl.......W.A.V.-.D.a.t.e.i.f.o.r.m.a.t.........

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtmultimedia_en.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                      Entropy (8bit):4.0
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3:j2wZC4n:CwZ
                                                                                                                                                                                                                      MD5:BCEBCF42735C6849BDECBB77451021DD
                                                                                                                                                                                                                      SHA1:4884FD9AF6890647B7AF1AEFA57F38CCA49AD899
                                                                                                                                                                                                                      SHA-256:9959B510B15D18937848AD13007E30459D2E993C67E564BADBFC18F935695C85
                                                                                                                                                                                                                      SHA-512:F951B511FFB1A6B94B1BCAE9DF26B41B2FF829560583D7C83E70279D1B5304BDE299B3679D863CAD6BB79D0BEDA524FC195B7F054ECF11D2090037526B451B78
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`...

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtmultimedia_es.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):17046
                                                                                                                                                                                                                      Entropy (8bit):4.488067064247524
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:qTAb/kqIRnp2Psn41kjT22m8T+dEw0Zpe4Q6fn87wZ9OdDq3D:MAb/kqIFUPsnKWhwcpeuf89da
                                                                                                                                                                                                                      MD5:F2E05CF385B73830C66997878BBE96C1
                                                                                                                                                                                                                      SHA1:1E5D672AB83BFB84ADE3C808F9A792F74FD1394B
                                                                                                                                                                                                                      SHA-256:0866911BFD4C6E78D3517EA298DE653CAEF0B7248AEFACDBA5236E7565A9B2A5
                                                                                                                                                                                                                      SHA-512:4C84CED507C284D7D50107F4086F30267F9057880F34320F54289F4E37761A4B7ABFA12A0BD6AD64E13ED0A7640E0B97555BE9B1D7B44B3C606CB0F581BBCA5A
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......es_ESB.....MJ....).OY......X.A..8@..............G.Q.......R.......W.>......D..........9...}q.......1..7..C|......OY...1...]>..)...]>...4......&.......Z.Qz....;...t..:.............$...|...2D.W....,..[C....).p....:5..#...7...[E..........P...n...C......5......"........u..0$......zn......*...'M.:....02.C......w\^..'......1.......=...TD..$Y..T...#.......+....N...g..K......q3... .......2....U..*!......)............T..#m.......H..b........1...!...1..!{.6....................0.......-...........V......W....Z.c.....w.l.E...F.l.E.....l.E..#..l.E..>....~.......~......6...;......./....a..8....S..... ^>.........5/......3.......w............ f.....<.........#......K.s...[..s...*....N..........<A..n..._....;/..Z....W..........\T.....X5A.....q.C.....x.........~...d...^...%...N......L....:..M...6c.....%H.......j.w. ..({.};...+...o....~......4...........J............W.....%...?....).....-~.|....=b..Q5..&...KT..".i..>.....J.f.o.r.m.a.t.o. .d.e. .a.r.c.h.i.v.o. .

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtmultimedia_fi.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):13883
                                                                                                                                                                                                                      Entropy (8bit):4.587256778643159
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:5xqudvG/srvG1YOIDcz0dIwMrOH5exEeTD5+oDwYKtToV8qxh+upeSIraT0wYnf6:/qudvG/srvAYO04xtTlrzKWeGgD6
                                                                                                                                                                                                                      MD5:F9B40CF075E511A54ACF25CD301B2A05
                                                                                                                                                                                                                      SHA1:C84D587DAC38A7E1747E420854978D1FC27A925E
                                                                                                                                                                                                                      SHA-256:628BE72C1DC70652AB302E2F8CCB9F3C328E7FDDDF7D8D1C5CE21056A9BA84F2
                                                                                                                                                                                                                      SHA-512:6D6C968D5A0F7FA46867A182261509C145522F8EC059AA4C42F28C4B38EF40A32CF2913F03BC800845B14BBE76AC6ED7F96E97C7BC4122C2B6D293D1E102D2BD
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......fiB... .X.A..,.......f.........Q.......Q.....V.R.....^.W.>...F.....-....1..,..C|......OY...&..c....0?..]>.. ...]>..$m.......L..............u...........t............................|...'n.W...."..[C......p.....W..#...+w...........n...W..............*m.................zn......*....o......t.:....%..C......w\^.........'.......2...TD......T....;......!....N...O.q3....t..............(....U.. ....T..............b........1...........6......&E......#_.........c.......l.E.....l.E.....l.E..2...6.../.......%(..{4.......a..-.. ^>...'.....).......(.......L............1..#......K.s......s...!>......0...n......../M..Z..............=.....t.X5A.....q.C.....x.........^...{...N...+..L....|..M...*...............,.w. ...U.};..."?......)t..........J..............?....w.....#..|....1...Q5......KT....i..2.....>.R.A.W.-.t.i.e.d.o.s.t.o.m.u.o.t.o. .(.t.u.n.n.u.k.s.e.t.o.n.)..........RAW (headerless) file format.....AudioContainerControl.....".W.A.V.-.t.i.e.d.o.s.t.o.m.u.o

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtmultimedia_fr.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):16502
                                                                                                                                                                                                                      Entropy (8bit):4.523787100967048
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:0zjDNrhYqqg7mPOnkq4wKAAEF8XDj7Ps7I1HzGetICvxbTV60PZtR2TeZm6Pynsm:07Nrhp3kCvsPs7am0bRPpEOOzB
                                                                                                                                                                                                                      MD5:DF28B5BCDEDC3FDEAD3749E6A0861F81
                                                                                                                                                                                                                      SHA1:7F64D46BD5D6BF7254242CF0DBDE179954123719
                                                                                                                                                                                                                      SHA-256:622FB2AB66D224C946BBBE8B4B06CCB45EA4B1368BA0E822A07BAD4B7C4BBD36
                                                                                                                                                                                                                      SHA-512:97D9053A6A236CA72D042597B4A150D703082810C1DE3542491938C93BFA871D2998A34C53F597913C80D5D02E0D7EF0E0CEB8D0609BB71B478E7E25A3317163
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......fr_FRB.....MJ....1.OY....'.X.A..6...............w.Q.....h.R.......W.>...0..D..........8...}q.......1..6T.C|......OY...0S..]>..(a..]>..-P......%d........Qz....E...t..:.............$...|...1..W....+..[C....c.p....8...#...5...[E...\..........n..........4...........0$......zn......*...&..:..../..C....#.w\^..'......0.......<'..TD..#...T...##......*S...N......K...........1....U..)e......)............T.."...........b........1.......1..!..6............. ....../.......,:.......'..V......W....\.c.......l.E...t.l.E...F.l.E.."U...~.......~......6...9............a..7|...S..... ^>...Q.....3.......2q......1............ ......;"........#......K.s......s...)....N...<......:>..n........9n..Z...............\T..-..X5A.....q.C...R.x.........~...b...^.......N.../..L.......M...5......$..........w. ..'..};...*...o...........3R.......-..J............W.....$...?..........,..|....;...Q5..%...KT..!.i..<.....H.F.o.r.m.a.t. .d.e. .f.i.c.h.i.e.r. .R.A.W. .(.s.a.n.s. .e.n.-.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtmultimedia_hu.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):16463
                                                                                                                                                                                                                      Entropy (8bit):4.657374409195896
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:RtGHxItMx2ssKAo0MZZPPXlDtAxb+tceVYwG9s4VbnzKMy9J:RtGHxItMx2ssKAo0MZZPPXlhkb+tceV3
                                                                                                                                                                                                                      MD5:286A43C2C0699E792A63123EE3D11D89
                                                                                                                                                                                                                      SHA1:2611BA80FBEF67CBE0C61CA981D5B37FD2841AEC
                                                                                                                                                                                                                      SHA-256:589D857B96CB1C8E6DCB018C8CDAF71BF06D31AA1271867F8572183C9394F8D7
                                                                                                                                                                                                                      SHA-512:92A7865CD3FF0CF2277100368193ABBF5557B4CF4323EF60DB998B1DA2317B9663E5199ADD6F6CA2F873942B5BAA40588253DE7F1335F0526380A00C63F4DA5F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......hu_HUB.....MJ......OY......X.A..6D......Z.........Q.......R.......W.>......D....G.....7...}q...<...1..5..C|....N.OY.../...]>..'...]>..,.......$.......p.Qz........t..9.............#I..|...0f.W....+..[C....K.p....8W..#...4...[E..........p...n..........3......!@.......U..0$...Q..zn......*...%..:.....v.C....u.w\^..&>.....0.......;...TD.."...T..."u......)....N......K....J.q3...........1....U..(.......(V.......y...T..!........b..b........1.......1.. /.6..................../3......+........Y..V......W......c.....k.l.E...x.l.E...,.l.E..!..l.E..<K...~.......~......6...9............a..6....S..._. ^>.........39......1.....................*.....:.........#....?.K.s......s...)3...N...L......:K..n...5....9_..Z....1.......P..\T..-..X5A.....q.C.....x.........~...L...^...1...N......L.......M...4I.....#..........w. ..&..};...*V..o...........2........e..J............#.....$)..?..........+..|....;P..Q5..%...KT.. .i..<.....B.R.A.W. .(.f.e.j.l...c. .n...l.k...l.i.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtmultimedia_it.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):17194
                                                                                                                                                                                                                      Entropy (8bit):4.475777186094896
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:UC3TmO4QKfnqfbFgmLf6i5zmQjEPsT2i31ZG+f4YdzPXegWZQ3lQPmNEx4EzO31c:Uyrx0CaPsqkhjEeDUSBNs3h
                                                                                                                                                                                                                      MD5:74E75500E4026F2DB8FF298B548E928A
                                                                                                                                                                                                                      SHA1:085B10C64A4CF22444174805BCB6BA0AB5CCFC57
                                                                                                                                                                                                                      SHA-256:ACA8D4DD145E671D827E582496F20281DC559AC91E7E13F88CF508BC2D6301ED
                                                                                                                                                                                                                      SHA-512:6C20E99834D3033FC85FF23A9EFDD3D2DB4A40CDF24D69C04CA2470EEC4FF38469CDBE89DD62C4C620E9E3456D123F205A8A958E4FC717018BA832E9764BB2EF
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......it_ITB.....MJ....'.OY....U.X.A..8...... ........).Q.......R.......W.>...@..D..........:X..}q.......1..8T.C|......OY...2Q..]>..*3..]>../^......'0........Qz....I...t..;.............%...|...3$.W....-..[C......p....;...#...7...[E...j..........n..........6......#...........0$......zn...T..*...(c.:....1..C......w\^..(......2.......>o..TD..%e..T...$.......,=...N......K......q3...!.......3....U..+I......*............T..$w..........b....#...1.......1.."s.6.............P......1........,..........V......W....R.c.......l.E.....l.E.....l.E..$#.l.E..?....~.......~......6...<v......0....a..9....S..... ^>.........5.......4.......E............!d.....=n........#....O.K.s...Y..s...+....N...Z......<...n........;...Z...............\T..0..X5A.....q.C.....x.....5...~...R...^.......N...y..L.......M...7......&V.......>.w. ..)..};...,...o...........5Z..........J............U.....&...?.............|....=...Q5..'...KT..#.i..?g....J.F.o.r.m.a.t.o. .f.i.l.e. .R.A.W. .(.s.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtmultimedia_ja.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):14337
                                                                                                                                                                                                                      Entropy (8bit):5.741374393238018
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:zn1pQ8PxuF2WQMeOSJASTswQZs7WWdiTA6V8x:c8PxuF2WQMeOSJASTxQZs7WbTAWs
                                                                                                                                                                                                                      MD5:27259833BCDE1CA4438A41863C9345DA
                                                                                                                                                                                                                      SHA1:ECD2404A31215E2D814125D3DBD5ADC7C6D45083
                                                                                                                                                                                                                      SHA-256:F9A888586C42C22894CCB4180257C2DE70299FF5D540087BC334DA74A8DD5969
                                                                                                                                                                                                                      SHA-512:EA82A4CEB38CD6B134AB37A6257D88D6019D25B82D6B6E855A4ABA19A2403D18CBE9AA463CFB857EE221CA787EF47080336D9A1459F23F3582E5BD726A4BF84F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......jaB.....MJ.... .OY......X.A....................Q.....q.R.......W.>...q..D....h...../...}q.......1..-..C|......OY...)D.l........]>..#4..]>..'....... .........M.......Qz........t..1......{..........|...)..W....%..[C......d.....9.p....0r..#...-J..[E..............n.......1..........,F..........0$......zn......*...!..:....(W.C......w\^.."+.....).......3:..TD...h..T...........$....N......K...........*V...U..#.......#........v...T...........S..v....7..b........1... ...1.......1...}.6.....[.H.C..................(.......&1..........V....c.W....W.c.......l.E.....l.E.....l.E.....l.E...\.l.E..3....~.......~...........~..6...1.......'....a../....S..... ^>.....5.t.........+.......*..............F......=......%.....2}........#....h.K.s......s...$`...N...!......2...n......w...}....1f..................Z...............\T..'..X5A.....q.C...a.x.........~.......^.......N......L....%..M...,...... /.......S.w. .."..};...%C..o....w......+i.......L..J................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtmultimedia_ko.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):11006
                                                                                                                                                                                                                      Entropy (8bit):5.779927341401355
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:rtqk8es6911OXRidgBnSQyHu5SW18acLhn:ps69rOHnzSW+acLB
                                                                                                                                                                                                                      MD5:0161C0622AE59F0331FDE6C2D901327B
                                                                                                                                                                                                                      SHA1:BC497F30FA42A5F73D2B4917FC2C12496EAFEE78
                                                                                                                                                                                                                      SHA-256:F512A5E985535D0309F737E6156F5959AE9B6405E65FF76ABAE5A139332F2C7A
                                                                                                                                                                                                                      SHA-512:903135B6C0D329F92B3617725749C64D1B24A28673BE325C471221C36378B01752AB57FB308CC6A69CA8D832C9BA1B472579320A55F48C3958093BE215B67107
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......koB.....X.A.."l.......q.Q.......Q.......R.....".W.>.........#....1..!..C|......OY......c....%...]>...o..]>...........&..............+.......k...t..$.........................|....2.W.......[C....[.p....$...#...!g.......(...n...C.......*...... .......P.......k..zn......*....+........:.......C....9.w\^...z.............'...TD......T....U...........N.....q3........................U.......T..........."..b...._...1...................5.................c.....=.l.E...\.l.E.....l.E..'...6...%X.......X..{4...m...a..".. ^>...U..... ........-...................&T.#......K.s...;..s....R......%...n........$...Z............P.=.......X5A.....q.C.....x.........^.......N...g..L....z..M... .......t.........w. .....};....'..................J....f.........?...........Y.|....&...Q5......KT....i..'..... .R.A.W.(..T. ....). ...|. ..............RAW (headerless) file format.....AudioContainerControl.......W.A.V. ...|. ..............WAV file format.....AudioContainerContro

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtmultimedia_pl.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):12237
                                                                                                                                                                                                                      Entropy (8bit):4.698903308278698
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:ej9dNDgWPsRh14pT260/C5nwL8CCQhoTBsyX2+N8dfu3:e5fDgWPsRXGq6sC5wYCCQ3z+Gf8
                                                                                                                                                                                                                      MD5:2F3EA58057D8F5EE06B505B41079C981
                                                                                                                                                                                                                      SHA1:13D38D2B95CC473A5C5CD1D6A3BD9FF69B5351B3
                                                                                                                                                                                                                      SHA-256:3C4CB711F6A59E5B19E4ADC0D0A6BE63C0BB55F15626AD640DB1BFD1D1363664
                                                                                                                                                                                                                      SHA-512:B8D5BE73F0291B4A63603541A0174C9E59E9C3C7A5560471B28FEC08B65D1ADFFBE4D52516D3A611E4B81941199103A4367B7A936198F12F2AEDC4245C810A08
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......pl_PLB.....X.A..&I......6.........Q.......R.....6.W.>.........'....1..%..C|....J.OY......c....*0..]>...W..]>...........f..........t..(.................|... {.W.....Y.[C......p....(J..#...%.......#..................zn......*......C....c.w\^......... ......,...TD......T....7...........N.....q3....L......!....U.......T..............b........1...........H.......<...............[.c.......l.E.....l.E..._.l.E..,...6...)............a..&.. ^>.........#^......!.......T............+-.#....i.K.s......s...........*...n..._....)N.X5A.....q.C.....x.........^......L....X..M...$`................w. .....};..........."...........J..............?....]......=.|....+...Q5......KT...ti..,.....@.F.o.r.m.a.t. .p.l.i.k.u. .R.A.W. .(.b.r.a.k. .n.a.g.B...w.k.a.)..........RAW (headerless) file format.....AudioContainerControl..... .F.o.r.m.a.t. .p.l.i.k.u. .W.A.V..........WAV file format.....AudioContainerControl.....8.D.a.n.e. .d.z.w.i...k.o.w.e. .w. .p.o.s.t.a.c.i. .P.C.M

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtmultimedia_ru.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):14109
                                                                                                                                                                                                                      Entropy (8bit):5.264248799271436
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:QKqItPsF4e6V1gHrptgfwwstDEp6SdZ9ZAUfiYNFzF0XJyo9Ea56V8C7Q7+ESqbj:QKZPsKZgt8dwYWXfEatierSqzb
                                                                                                                                                                                                                      MD5:1841A70C30F9A2F3AA3F5BAEFF9208EE
                                                                                                                                                                                                                      SHA1:3C9594CF1F3E2E64A74C32094F3B9A032C7E7FB1
                                                                                                                                                                                                                      SHA-256:32C1118415F25A378D356CF01652393C8F9063145BC8F8A93C4F992166FA9D4D
                                                                                                                                                                                                                      SHA-512:1C6A6A2775109FA28717913E35370CDCA5BD60C229CFD5BD63066044964EB165D65634B32E5BC6BBC4D6CBFACDB9C35B5192295CFDB85A88A9FC0A6E71704CD2
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......ru_RUB.....X.A..-..........Q.......Q.......R.......W.>..........b...1..,|.C|....>.OY...&..c....1...]>......]>..$M......................#...........t../.........................|...'N.W...."..[C......p..../...#...+............n..................*...............{..zn......*...........@.:....%n.C......w\^...b.....&.......2...TD...;..T...........!P...N.....q3............<......'....U.. P...T...i..........b........1..._.......6......&.......#........g.c.......l.E.....l.E.....l.E..3w..6...0.......$...{4.......a..-.. ^>.........*.......(.......J......j.....1..#....O.K.s......s... .......1[..n...U....0...Z....C.......P.=.......X5A.....q.C.....x.........^...e...N......L....:..M...+=................w. .....};...!.......)p.......k..J...........s..?....5.....#..|....2`..Q5...A..KT....i..3.....@.$.>.@.<.0.B. .D.0.9.;.0. .R.A.W. .(.1.5.7. .7.0.3.>.;.>.2.:.0.)..........RAW (headerless) file format.....AudioContainerControl..... .$.>.@.<.0.B. .D.0.9.;.0. .W.A.V.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtmultimedia_sk.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):9896
                                                                                                                                                                                                                      Entropy (8bit):4.651417016192566
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:ymzlPsi1CPNRUNEjHE4YdKNoKBrbd8vFPe:1Psc6gEjHE4YdaNBH2vFPe
                                                                                                                                                                                                                      MD5:D9B73E1E553693BBE20729B972166E70
                                                                                                                                                                                                                      SHA1:6FBE8ACAF2671791C9043508D4FC6D8E5B804C7B
                                                                                                                                                                                                                      SHA-256:82F544F31FFB0CE80340F445AD2C8E2BA57969413EF9B5D10FE4322BB96A6851
                                                                                                                                                                                                                      SHA-512:BA376AE10C71C9770D60B6E3D177F5FE26C7A496B53E4F50686B6B538B71CB7D397B01012C334C26C85B2A62B436E7600B4CE847AF7D93F1514101DD9EF6175C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......sk_SKB...8.X.A.. q.].....N.....!....1.....OY.......]>...3..]>.....................+........t.."Z...A.......=......|....>..|......W........#....<..'............0..........*....5..*....=.:.......QM^.....w\^..........#.......'.......~...U...-.......i...............................Q.......0.........l.E...n..6...#?..........&A......b...D...a..!.. ^>......tQ.................. .........'....Z.#....h..s...........#...a...h.........nE........"..N.....$..Z....}..\T......y.......L....y..M..............w. .....};...............J....Y..?....y......4.nP9......Q5......G.....i..$A....".R.A.W. .f.o.r.m...t. .s...b.o.r.u..........RAW file format.....AudioCaptureSession.....".W.A.V. .f.o.r.m...t. .s...b.o.r.u..........WAV file format.....AudioCaptureSession.......P.C.M. .a.u.d.i.o. .d...t.a..........PCM audio data.....AudioEncoderControl.....0.K.a.m.e.r.a. .n.i.e. .j.e. .p.r.i.p.r.a.v.e.n............Camera not ready.....CameraBinImageCapture.......J.P.E.G. .o.b.r...z.o.k.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtmultimedia_tr.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):13295
                                                                                                                                                                                                                      Entropy (8bit):4.762391970296969
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:05P7BsqxeP7OZaiOkP+HxW6gt5wQha7JVjSprkcJmcM8:AP7BsqxK7OZ9ORHQdt5XhAJVjSprtJmY
                                                                                                                                                                                                                      MD5:E7E3EA251F76ED3C680CE40CB2C62250
                                                                                                                                                                                                                      SHA1:92625294D74741F479D28C2C3110DCF0C815DB2F
                                                                                                                                                                                                                      SHA-256:1C79A82DCD0314EBEC350293FFFE9E2CD35CCC6BD63C449C178D42EF1DA375CF
                                                                                                                                                                                                                      SHA-512:F7997F9424C65CC9F880D211919E06157073B9083BA54435BF7BAF2AD806104DEA4E985EB055998DFECD73D00613E42F1C62C799AA4BA505A0BDDF36C3AC8594
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......tr_TRB.....X.A..**.......C.Q.....f.Q.......R.....0.W.>...n.....+....1..)..C|......OY...$..c........]>......]>..!...................................t..,..............h..........|...$..W.... s.[C......p....,1..#...(............n...........|......'..................zn......*....%........:....#..C......w\^.........$g....../...TD...C..T............8...N.....q3....8..............%Y...U...X...T...c..........b........1...........B......#....... ..........c.......l.E.....l.E.....l.E..0g..6...-......."...{4.......a..*.. ^>.........'A......&.......F............/..#......K.s...Q..s............m..n...C....-7..Z....!.........=.......X5A.....q.C.....x.........^...g...N......L....|..M...(;......&.......r.w. ...#.};...........&........-..J....~.........?..........!I.|..../l..Q5...m..KT...@i..0.....8.R.A.W. .(.b.a._.l.1.k.s.1.z.). .d.o.s.y.a. .b.i...i.m.i..........RAW (headerless) file format.....AudioContainerControl..... .W.A.V. .d.o.s.y.a. .b.i...i.m.i.........

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtmultimedia_uk.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):15781
                                                                                                                                                                                                                      Entropy (8bit):5.306567482773278
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:1RamDXePsF0HwX1Rsd6ml+0HHCiwMmcrSWo2:XamDXePsF0HwXfsYm+0HHCiwM5SWo2
                                                                                                                                                                                                                      MD5:1E8E91CAD32A6610D54E838C803E93C7
                                                                                                                                                                                                                      SHA1:073965FDDD20601A8348B548DDB174B832D735B1
                                                                                                                                                                                                                      SHA-256:EBF67318490F70C765B50B6CC4EB3CD4C0EAB9FF10A19BC44A0489B24CECD834
                                                                                                                                                                                                                      SHA-512:29C1F790613F0B2D41685F0F6A6B910F66BD61C035F8A5B3CF4B18A7C92E4D221B1DC6C27DE67803E8FE654DE3B3BCEB2746F5B510D9CB79AC1BC943D1D73B38
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......uk_UAB.....MJ......OY......X.A..3.......j.........Q.....8.R.....p.W.>......D....C.....5 ..}q...4...1..3|.C|....V.OY...-...]>..&3..]>..*.......#t......v.Qz........t..6<............"-..|......W....)`.[C....;.p....5...#...2...[E..........v...n..........1...... ...........0$...S..zn...&..*...$..:....,..C....u.w\^..%.......7......8...TD..!...T...!Y......(....N......K....8.q3....p....../+...U..'3......&........s...T.. ...........b....{...1.......1.....6....................-a......)........]..V......W......c.....'.l.E...l.l.E...$.l.E.. ..l.E..9....~.......~......6...7.......,6...a..4....S...c. ^>.........1E....../...........................8.........#....}.K.s......s...'....N...D......7w..n........6...Z....u.......t..\T..+..X5A.....q.C...~.x.....9...~...H...^.......N......L.......M...2i....."..........w. ..%..};...(...o...........0...........J..................#...?..........*F.|....8z..Q5..#...KT....i..9.....@.$.0.9.;. .D.>.@.<.0.B.C. .R.A.W. .(.1.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\Qt5\translations\qtmultimedia_zh_TW.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):9951
                                                                                                                                                                                                                      Entropy (8bit):5.774304533562878
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:2RHL3+0SNWeYxupp/mptZFp4tiUIHuewNSrNSh5NBBVJV69tDxTZBm59bN/5yQKq:IrkrYsEt14q8YrYLBbJVGDL4xK8NfYI
                                                                                                                                                                                                                      MD5:0017FC26EB26E431C09349A310AD6208
                                                                                                                                                                                                                      SHA1:C37FC24AED1827F81D2B2B8C673DC9BDD5CE7676
                                                                                                                                                                                                                      SHA-256:981492BD3B7A83B280F7DE296BE80D55FC3150A45358F93745E4BE3DDEEC5CB7
                                                                                                                                                                                                                      SHA-512:55896D19DA1CDDE36201D9B0EE268298CE63CB1F7145762E66E426EACCDAC5F8333FD617986697937EC5F000274BF2F066F38E3CEE879649D35E75CFCC92F034
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......zh_TWB... .X.A..........v.........Q.......Q.....>.R.......W.>..............1...T.C|......OY....y.c....!...]>......]>..........................O...........t.. .........................|......W.......[C....5.p.... K..#................n...7.......r..............<..........zn...z..*.............:.......C......w\^...&............."...TD......T..../...........N.....q3....................s...U...r...T..............b........1...................#.......9.......m.c.....9.l.E...D.l.E.....l.E..#U..6...!p.......b..{4.......a...<. ^>...s.................................."R.#......K.s......s...........!...n...{....!...Z..............=.......X5A.....q.C...F.x.........^...i...N......L....2..M....]......D.......p.w. .....};....y.......^..........J....b.........?.............|...."...Q5...[..KT....i..#.......R.A.W. .(q!j..-.). j.hHh<_...........RAW (headerless) file format.....AudioContainerControl.......W.A.V. j.hHh<_...........WAV file format.....AudioContainerC

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\QtCore.pyd

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1982976
                                                                                                                                                                                                                      Entropy (8bit):6.605444090115069
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24576:iDQwlm099ovDcJ/8Hf1YrZ8exoXpqD1WfK7MBEuaRgnmoD8z4SqUDOsWsJ5/wiGH:iDlmEXwK7MBznZDGj8em
                                                                                                                                                                                                                      MD5:21609415D185489378FDC43809BFD071
                                                                                                                                                                                                                      SHA1:C42FEF56FD2CE70CD1FAA64E5662874D2029AAB3
                                                                                                                                                                                                                      SHA-256:D120FCCEC49797A904595EB739781DE4A5976080D4F6E8BFCA455F186813BB6E
                                                                                                                                                                                                                      SHA-512:3B1CF23F3BB25E49D12B30468DFDFAC752892FAF26F43F948CF5DFB8EB45ADFAEF62B72B2D6D39EEE807D63D306A8DA72709A5A2654E51A046D50744CE6B2E34
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P.B*..,y..,y..,y..y..,yF.-x..,yO.-x..,yF.)x..,yF.(x..,yF./x..,y..-x..,y..-x..,y..-y.,y..)x6.,y..,x..,y...x..,yRich..,y........................PE..L....i%e...........!................i........................................p............@......................... ...L...l.......................................|[.......................\.......[..@...............t7...........................text.............................. ..`.rdata..............................@..@.data........P.......4..............@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\QtGui.pyd

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2022400
                                                                                                                                                                                                                      Entropy (8bit):6.666787807656882
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24576:yxkbwbo6E2S2IQ9Vx83ZLj2EC/GYK8Wfyx61ZWe18hG:prpxi61T6
                                                                                                                                                                                                                      MD5:F72EB5F6A046D9AA50AB0A41C88CC09B
                                                                                                                                                                                                                      SHA1:7285E4575CA6742430F76AB383B32D3FA0539C1D
                                                                                                                                                                                                                      SHA-256:9E8655831F3C3332D451D93AE059DA9AE704B222ACBE6455A7890D25CABAECC5
                                                                                                                                                                                                                      SHA-512:7698825724904BB8C78969F509D87D1BF66147BFA3C5E3F8916170D1FD4735A7D02EA10EB2A658BB7B9D6C8C1C105ECA284A2472E57A78BA265A7D587CEF8991
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T.................5.....B.......K.......B.......B.......B..........................].......................Rich............................PE..L... j%e...........!.........6.............................................. ............@.............................L........................................o...i...............................i..@...............4=...........................text...=........................... ..`.rdata..............................@..@.data...,...........................@....reloc...o.......p...l..............@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\QtMultimedia.pyd

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):736768
                                                                                                                                                                                                                      Entropy (8bit):6.518668790566688
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6144:SUjLOR+AfmVh9Rv8DvgUGtuqPYldhiYXtFwMRBJV57ukR27rifYyu2gQX9//TreF:qR+AuRXl3YdtBjKpGH41P1T
                                                                                                                                                                                                                      MD5:18C5FF0698F514AC2F3063CFE9D86324
                                                                                                                                                                                                                      SHA1:A577F195E3BA007CB012EB51CD4FAAAB8141B041
                                                                                                                                                                                                                      SHA-256:F2A0323F856E90EE55BCFA7A965AE030F0CEA0B28CFDBA200660CF5D38DC116D
                                                                                                                                                                                                                      SHA-512:926655B1F3061274928293A406CBAF39240B3105ADFA4C63758DECC759A16A324FBF157C30D384A7929808054F6B73AD3103A6C1AC9F063BD7C8562D42D7F6C8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~.r...!...!...!.g.!...!.j. ...!.w. ...!.j. ...!.j. ...!.j. ...!.b. ...!To. ...!...!...!.j. ...!.j. ...!.j. ...!Rich...!................PE..L....j%e...........!.....T...........W.......p...............................p............@......................... ^..X...x^...............................p.......2...............................2..@............p..0............................text..."R.......T.................. ..`.rdata.......p.......X..............@..@.data........p.......N..............@....reloc.......p.......>..............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\QtNetwork.pyd

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):566784
                                                                                                                                                                                                                      Entropy (8bit):6.558511749339486
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12288:N/EhG5Fp+mXwSZMB6jlniiuZOBWqVBbEs0HlfqbnV:NshwXMB6jlnyNqb
                                                                                                                                                                                                                      MD5:A766FC404DDB88C55F4EA8D8073BF2C0
                                                                                                                                                                                                                      SHA1:46501B3770393C7BCFB2840D491B52E217D03233
                                                                                                                                                                                                                      SHA-256:B6F3AEB8E0297F25EC37CD66B8600473631140B4BFD60D1C3119B172F89DFD68
                                                                                                                                                                                                                      SHA-512:451B6FCA2A56D7B53D3E15D96223ED8AEDC5C9A096B10B4FF9BC8F9D11C9D26F31E99564723A9CA8073B97647692EA45EFE2414EFFC7B659C1E72B9AAE7721BC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... }!.d.O.d.O.d.O.md.`.O.6iN.f.O.?tN.f.O.6iJ.w.O.6iK.n.O.6iL.e.O..aN.f.O..lN.a.O.d.N...O..iJ.f.O..iO.e.O..iM.e.O.Richd.O.................PE..L....j%e...........!......................................................................@..........................c..T...$d..................................@....P...............................P..@...............|............................text...2........................... ..`.rdata...m.......n..................@..@.data.......`.......L..............@....reloc..@...........................@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\QtPrintSupport.pyd

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):200704
                                                                                                                                                                                                                      Entropy (8bit):6.451056735860483
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6144:4Uo3QTpDjqhgaxbZBgId8Bdq5+OZsMwVadqk0Jxk:Ho3H8Kik
                                                                                                                                                                                                                      MD5:760EC3E14BAE77160CE97DB6149C4894
                                                                                                                                                                                                                      SHA1:66264513E4BBE59D0D03F7C177E5B8CE7707A9AE
                                                                                                                                                                                                                      SHA-256:8209FF8EA4C864E2FCD1FA90B6635D619FD3B67F2022DD4F30A487AE25DBE0FD
                                                                                                                                                                                                                      SHA-512:7E1200A07E86DEEE3602C1A598E1E78821AA931E9EC3FA60123589E1088BABD4813CFCB2672B10CD41F382D5D13208A60B11A4673E1CB1B88A3B160EA05E8A6B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........B.....................................................T..............................Rich...........PE..L....j%e...........!.........>...............................................P............@.........................Pr..\....r...................................C..4e..............................Pe..@............................................text............................... ..`.rdata..~...........................@..@.data...04.......2..................@....reloc...C.......D..................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\QtWidgets.pyd

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4016128
                                                                                                                                                                                                                      Entropy (8bit):6.554254317806606
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24576:o/OciWYCGBjmGJpHzrZr9MV7vNPDmAg0gT5ITHFfvwsbxs8BN6OPeHSBNM0c4E1/:yAhrZA7VNv1c4EZL
                                                                                                                                                                                                                      MD5:7DF4352378289E01C7F83D68FEC6BABC
                                                                                                                                                                                                                      SHA1:A5733C04CC0198420386ED2EA75795AEF59B9257
                                                                                                                                                                                                                      SHA-256:F81DBD368384F1D0DBA677EB6BE12206D2A31F6DA120ABD8BEDB6BFF612DE6B9
                                                                                                                                                                                                                      SHA-512:8871A008FB43BF154F599F4CBE435609EFFD8A5CE6D2B6271C51F22E5E1C297915FBDF217AA5950AF60D53D1E83FB18DD27451C2C8612841092D802D35E5C2AA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................:..............................................Z.................................Rich...................PE..L...Aj%e...........!......$...........$.......$...............................=...........@.........................../.T...d./...............................7.h......................................@.............$..\...........................text.....$.......$................. ..`.rdata..`[....$..\....$.............@..@.data...0.....4.......3.............@....reloc..h.....7.......7.............@..B........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\PyQt5\sip.cp310-win32.pyd

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):94720
                                                                                                                                                                                                                      Entropy (8bit):6.461428241926437
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:cSkWOqWw+FD4BXybYeosVmUBOSMZraWl/HzJOLFgGPizWrcfUPrhNLsOsmRyLMsz:sWOHDFEdBRStWFTJO1ayIinRyMss3Yol
                                                                                                                                                                                                                      MD5:52B89F57276FF69B6F5EAFB1E23E372F
                                                                                                                                                                                                                      SHA1:E24FC90391A33228674CA5D3E23C466F78C49B8B
                                                                                                                                                                                                                      SHA-256:DAFED1ADDD8A8195B1F7FB4A5A46F89900025A0FCD46932520F7AEB20A354BF4
                                                                                                                                                                                                                      SHA-512:DA79EDCB64DAD0550EF676369B59E606C7B763D306EC431D77A43AD5CC5AE605704BAEE5E3B210FB6CBD00C28B4EDA1704DCF973FCC04E04601BA0A04BFB0417
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........?..wQP.wQP.wQP...P.wQP..PQ.wQP..PQ.wQP..TQ.wQP..UQ.wQP..RQ.wQPJ.PQ.wQP.wPPEwQP>.YQ.wQP>.QQ.wQP>..P.wQP>.SQ.wQPRich.wQP........PE..L...>.#e...........!.........d............... ............................................@..........................D..T...TD.......................................?...............................@..@............ ...............................text...~........................... ..`.rdata...6... ...8..................@..@.data........`.......J..............@....rsrc................X..............@..@.reloc...............Z..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\VCRUNTIME140.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):76168
                                                                                                                                                                                                                      Entropy (8bit):6.765544990184352
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:zHHuqvERNjBwySXtVaSvrgOFw9RxKMn5ecbCKnIY7:zHHZMRNjKySdLcOiH5ecbCKnN
                                                                                                                                                                                                                      MD5:1A84957B6E681FCA057160CD04E26B27
                                                                                                                                                                                                                      SHA1:8D7E4C98D1EC858DB26A3540BAAAA9BBF96B5BFE
                                                                                                                                                                                                                      SHA-256:9FAEAA45E8CC986AF56F28350B38238B03C01C355E9564B849604B8D690919C5
                                                                                                                                                                                                                      SHA-512:5F54C9E87F2510C56F3CF2CEEB5B5AD7711ABD9F85A1FF84E74DD82D15181505E7E5428EAE6FF823F1190964EB0A82A569273A4562EC4131CECFA00A9D0D02AA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................{.........i.............................................................Rich....................PE..L...>|.a.........."!.........................................................@......{.....@A......................................... ...................#...0.......#..8............................#..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\_asyncio.pyd

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):56600
                                                                                                                                                                                                                      Entropy (8bit):6.701238830377098
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:FDUfUUn5KdYveu2H7sz9YHIRTRILOnY7SyOPx3A:FDgDn0KPz9YHIxRILOnYIx3A
                                                                                                                                                                                                                      MD5:252C9B6FCC220FE16499ABF4A8E2A2E8
                                                                                                                                                                                                                      SHA1:03327874A1153E9FE640E6F5E8D987CCC84034C4
                                                                                                                                                                                                                      SHA-256:E01FDB89380EBF58700F40DCEBAFCB37F24970C8EA1F33063BDEA873B53E720D
                                                                                                                                                                                                                      SHA-512:F68C9D043D5EF7A32098DDD9C1622F761F88DA31CA47450AB1D95E51AB8CD06E1658DC57DB150AAF51B682F7F285654E6BBD118B3CA8400BB5B2D461BDC78926
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:...T..T..T....T...U..T...Q..T...P..T...W..T.m.U..T..U..T..U.+.T.m.\..T.m.T..T.m....T.m.V..T.Rich..T.........................PE..L...9.,d...........!.....R...\.......V.......p......................................B.....@.............................P......d......................../..........(...T...............................@............p...............................text...TP.......R.................. ..`.rdata...7...p...8...V..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\_bz2.pyd

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):72472
                                                                                                                                                                                                                      Entropy (8bit):6.8432832170573255
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:QxDhX4Vb2zMIsTRGxT+0q8i9qK5ILCVwQ7Sy8Pxer:mhi2zvsCK0ti9qK5ILCVwQ6xw
                                                                                                                                                                                                                      MD5:5C952E57426E429F6F4CEC9FEB841815
                                                                                                                                                                                                                      SHA1:83BFD2108E188909C7FF3B294AB9C99336D02D06
                                                                                                                                                                                                                      SHA-256:B682E9E8152036BDEBF4CA5410D3C0F88FA3272A969830F63C7B61BB1F0DA89F
                                                                                                                                                                                                                      SHA-512:2B6AB5F24E7E232C8906AC12C5A4994CFCF1B061FFC25407F278DE3D97664716C24E58237EE6EC48949AC6C1F4522AA1CA4C5238015D128E3A9BE602D2CE0ED2
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j.:...i...i...i.svi...i.~.h...i.d.i...i.~.h...i.~.h...i.~.h...i.~.h...i.s.h...i...i...i.~.h...i.~.h...i.~.i...i.~.h...iRich...i........PE..L...Y.,d...........!.........D.............................................. ......!.....@.............................H................................/.......... ...T...........................x...@...............8............................text............................... ..`.rdata...-..........................@..@.data...8...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\_cffi_backend.cp310-win32.pyd

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):155648
                                                                                                                                                                                                                      Entropy (8bit):6.63555006600095
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:VeqZA3oBbzbl0uLOEshrI/hTR6wlu556DXbU7xxyTL3qyAUHPN0s:4oA3RuLpshrQlu55uXbmxyTL6yDHPK
                                                                                                                                                                                                                      MD5:84E1F73A3E4E6D4B6AFD8D9EF10B1924
                                                                                                                                                                                                                      SHA1:5BD989147215F91D0FD2A17C23D02BBF9FAC89BF
                                                                                                                                                                                                                      SHA-256:FF874A41DC5D656BC24E48D5193345C09281EBFB7EF7724EF760FC9B1FF37439
                                                                                                                                                                                                                      SHA-512:57C66BB7AF04512BDE04AA82F75087D2B7F5A82B67B59E860DAA4A660E046891CBE62309B05305D725F71C30DEBFD2829068485164BC46F106355DD79BF5CDCF
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#...p...p...p..Bp...p..q...p..,p...p..q...p..q...p..q...p..q...p[..q...p...po..pW..q...pW..q...pW..p...pW..q...pRich...p................PE..L...<..e...........!................-.....................................................@......................... %..h....%.......p........................... ...!.............................. !..@............................................text...M........................... ..`.rdata..4...........................@..@.data..../...@.......$..............@....rsrc........p.......<..............@..@.reloc... ......."...>..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\_ctypes.pyd

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):108312
                                                                                                                                                                                                                      Entropy (8bit):6.644234290397436
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:qS6mSAe9tVW/dhyGfnH/Jt5Phld/7VILLPf17Mxk:qS6mzInWlhyiH/Jt1d/7wJ
                                                                                                                                                                                                                      MD5:FF0992DFB0D4D90BDCEAAD68246C5C22
                                                                                                                                                                                                                      SHA1:3508B7D730DDE3DB94AE413625451AE8CAA0BD7D
                                                                                                                                                                                                                      SHA-256:F879F86BF65CE05EE3467DF65C55B9837F9DFFB0F024C350C9A9869A08609759
                                                                                                                                                                                                                      SHA-512:8BEBC01958D71B327CBC39ED04BC53F6484CAA0232A1FD71E6691BDAA89FCBC766BC888D45870DC24D1190C48A0AE0A58C447EC936E34DB23059EE6F35A138BB
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.....................H..............................................Y........&................$..........Rich...........................PE..L...W.,d...........!................................................................)]....@.........................P4.......4.......p...............x.../.........../..T............................/..@............................................text...!........................... ..`.rdata..TK.......L..................@..@.data...l....P.......:..............@....rsrc........p.......V..............@..@.reloc...............`..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\_decimal.pyd

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):195864
                                                                                                                                                                                                                      Entropy (8bit):6.894532348319941
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:HJwcAu1LgDNsFyrbz5arkp1Lq00rBCXN4hmuqaxgU3pJMWlXgWcW+33SgRILOqXv:HNAg8rRaULECXN4Quqax33XMW5gJW+34
                                                                                                                                                                                                                      MD5:FBE8BB3048DF17FF9DDB0972825FDA71
                                                                                                                                                                                                                      SHA1:E3AD65446B60554CB9F7C45700BE2EAD1453772F
                                                                                                                                                                                                                      SHA-256:283AA604D532B6239AA8D8794C8D8A4F3A11C93DFBCEF846315CFD74F5E07E2F
                                                                                                                                                                                                                      SHA-512:48C66F10F9E79359DF63FD381C21B4559438DAE7AD84C625EFE1C7AB802F31BB8D326650F654C8EA504791595D801679A6F156F7ED90DA98AEBC04D2120C90A6
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m<.c)].0)].0)].0 %"0'].0{(.1+].0{(.1%].0{(.1#].0{(.1-].0.(.1*].0b%.1+].0)].0.].0.(.1&].0.(.1(].0.(N0(].0.(.1(].0Rich)].0................PE..L...E.,d...........!................(........ ......................................R.....@.............................P...`............................/......t.......T...............................@............ ..d............................text............................... ..`.rdata....... ......................@..@.data...x...........................@....rsrc...............................@..@.reloc..t...........................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\_hashlib.pyd

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):49432
                                                                                                                                                                                                                      Entropy (8bit):6.749500211425154
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:H+OYENKnr4deUNXT1Ee20RILOIS5YiSyvWPxWEa1E:HbYENsr4MWT1Ee20RILOIQ7SyOPxl
                                                                                                                                                                                                                      MD5:2AC2DEE9FDB32BE30FEFD4FDB5D280B3
                                                                                                                                                                                                                      SHA1:5E803C5D649521CAB34BFC7EF6DC44954915220D
                                                                                                                                                                                                                      SHA-256:F10C90062EAA68F41B1A6B34F3796E3AB8E0D765E595236E893CFF9FAD30116A
                                                                                                                                                                                                                      SHA-512:86A7DFE6F15FCE67ACCBC84262C73D25F2E440B7529143235B9B32F15F7804F99206E24C5ED8E5219BB5895BF6E397304BA153E064FF97EED23F5E92469E901E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I.&...H...H...H.......H._.I...H._.M...H._.L...H._.K...H...I...H.F.I...H...I...H...I.H...@...H...H...H......H...J...H.Rich..H.........PE..L...q.,d...........!.....>...T.......C.......P.......................................+....@..........................w..P....w.........................../..........(s..T............................s..@............P...............................text...t=.......>.................. ..`.rdata..j4...P...6...B..............@..@.data...h............x..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\_lzma.pyd

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):148248
                                                                                                                                                                                                                      Entropy (8bit):7.03034519275223
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:VcSEmJbTMWUCFHRQWtwjEYZLlFrFvIB+hBJQ8T374Tu2d//zHf39mNoBJNWQ5ILt:GwUC9RQWtwjEGgYXT3CTvYOVWQI
                                                                                                                                                                                                                      MD5:6174470C775AD7529891E1BA3C54F87B
                                                                                                                                                                                                                      SHA1:A1536BDECFD42F99BD1CC561EC727D81F613D205
                                                                                                                                                                                                                      SHA-256:E1E346F8B9FA43EC5519166D92625168EBB642A70F52611545117631C74181BD
                                                                                                                                                                                                                      SHA-512:0595EA1C8D2784D1C8272E29D8E9C1C074FFA1CA14116AE7E65C52DA1D1E87A0AE1FD9D3EF285F887A8847008DA1EBE3E1F6ACF1294AFDC9E2F31216F7AB7CB4
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*.P.D.P.D.P.D.Y...T.D...E.R.D...A.[.D...@.Z.D...G.S.D...E.S.D...E.R.D.P.E.1.D...L.j.D...D.Q.D.....Q.D...F.Q.D.RichP.D.........PE..L.....,d...........!.....f..........<k.......................................@.......C....@.............................L.......x.... .................../...0..t.......T...........................H...@...............x............................text...[e.......f.................. ..`.rdata..b............j..............@..@.data...H...........................@....rsrc........ ......................@..@.reloc..t....0......................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\_multiprocessing.pyd

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):29976
                                                                                                                                                                                                                      Entropy (8bit):6.798507676792536
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:aQJATEdgw8HYcj4HjzjuRTBax6i+5/ZMILWBLCHQIYiSy1pCQHcPxh8E9VF0NyUC:9kHYDs88HFZMILWtY5YiSyv8PxWEaC
                                                                                                                                                                                                                      MD5:7AB685D3F467C7029DEE1A943BB19065
                                                                                                                                                                                                                      SHA1:BCADE206E6863874EAF72A1CAA748FBDEE916970
                                                                                                                                                                                                                      SHA-256:91889BBF6DFADFC026276141A4260D7F2C19090FDE9EE04490B9211DD3933EBA
                                                                                                                                                                                                                      SHA-512:D8E8CABA0D030FA0433D71D376608ACA2DA003D76C67FE9AB8C7B7E4A6AA7E0C21454E1D45CD052BB67B681B57094BDFA9CD634C1A1AE22C104568D20D13B02A
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ Nb.A 1.A 1.A 1.9.1.A 1.4!0.A 1.4%0.A 1.4$0.A 1.4#0.A 1i4!0.A 1.A!1.A 1.9!0.A 1i4(0.A 1i4 0.A 1i4.1.A 1i4"0.A 1Rich.A 1........PE..L...D.,d...........!.........,...............0......................................./....@.........................P<..`....<..x....`...............F.../...p.......7..T............................8..@............0..H............................text...t........................... ..`.rdata.......0......................@..@.data...`....P.......4..............@....rsrc........`.......8..............@..@.reloc.......p.......B..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\_overlapped.pyd

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):42264
                                                                                                                                                                                                                      Entropy (8bit):6.794037552069512
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:Hv9eDBCwgCnLEggqKboqjzezQPxNILXtV05YiSyvdPxWEaoC:FwgULj8NvezQPxNILXtVe7SylPxRC
                                                                                                                                                                                                                      MD5:0A4AAABED72E8E08143EB129E5E24407
                                                                                                                                                                                                                      SHA1:A85094E29FE1DE755DFB2BB2650378CA7BD1F5F2
                                                                                                                                                                                                                      SHA-256:2233C561A18D92ADC2F4C56D6C55ADFB4A01049E801BDD3BB2A03CEE125F6E43
                                                                                                                                                                                                                      SHA-512:79942D76D23376C71028EED8658E2C938DFE64D54D56FC60C0CA8F2FCA9515D7A5A24A5ABFDCB51DFF944ED2F7BEB17B6D5BA50D45A62DE9A7DB4FDCF6A04F62
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........P..f...f...f......f...g...f...c...f...b...f...e...f...g...f...g...f...g...f...b...f...n...f...f...f.......f...d...f.Rich..f.................PE..L...H.,d...........!.....8...>......]<.......P......................................{.....@..........................h..X...(i.......................v.../......$...8d..T............................d..@............P...............................text...$6.......8.................. ..`.rdata...#...P...$...<..............@..@.data................`..............@....rsrc................d..............@..@.reloc..$............n..............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\_queue.pyd

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):28440
                                                                                                                                                                                                                      Entropy (8bit):6.828727954203399
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:gtbUDut6rf1vYvVILQUG5YiSyvhPxWEa4:uUa8f1vYvVILQU87SyJPxp
                                                                                                                                                                                                                      MD5:2E6FE907E37F3F9154DB187C1B7F8232
                                                                                                                                                                                                                      SHA1:77F25B5D95097DFDA0F9FD58632F8711091547CD
                                                                                                                                                                                                                      SHA-256:763D333C80F4C11861C9210C4BD53FEDA24B5598AC9270391B2EC250BD52B636
                                                                                                                                                                                                                      SHA-512:D87683A681D576CB334BDF2CE385E6BDB115D18232E160F17535A6BA432342604ADE6404F085F64ECA63C639860968603D4D8DB11A11520A1BC44B2A57FE00AF
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............p..p..p....p...q..p...u..p...t..p...s..p.m.q..p..q..p..q...p.m.x..p.m.p..p.m....p.m.r..p.Rich..p.................PE..L...H.,d...........!.........*...............0............................................@..........................<..L....=..d....`...............@.../...p..\...`8..T............................8..@............0...............................text............................... ..`.rdata.......0......................@..@.data...@....P.......0..............@....rsrc........`.......2..............@..@.reloc..\....p.......<..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\_socket.pyd

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):69912
                                                                                                                                                                                                                      Entropy (8bit):6.7529275237414
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:XAqVY6E4oksA1MT9f8+CeJ+8WyKTVVILLwt7SyJPxl:XAqVY3FA1MT9f8DeJ+8W9TVVILLwtvxl
                                                                                                                                                                                                                      MD5:A092B2DE9E1128F73E26D142A5B2D68B
                                                                                                                                                                                                                      SHA1:0C5E38B11389ACC870056200710F4152FBB03429
                                                                                                                                                                                                                      SHA-256:389D2B94A3562879F9E0A17CACE1574EE308AC39A5D9F5659F885284C9B2D19E
                                                                                                                                                                                                                      SHA-512:60D45D3BEF3C8729CA879816A321B8508AE304A84499E715CB2AD7352273A6482B82C960092311E3EF40F1326D6533CE25B61953A197F7D3FBCE2C0CF511D5E2
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&...b...b...b...k...f...0.`...0.n...0.h...0.c.....`...b......)...e.....c.....c.....j.c.....c...Richb...................PE..L...n.,d...........!.....f...|......tk....................................................@.........................P...P................................/..............T........................... ...@............................................text...:e.......f.................. ..`.rdata...Z.......\...j..............@..@.data...(...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\_sqlite3.pyd

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):72984
                                                                                                                                                                                                                      Entropy (8bit):6.755617527508713
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:a85mWPlKtIGSqpnoOUNGHxvttnGyOuPrF2dRILOQxyO7Syo/PxjP:XmdiHqpjmGx1tnGEzF2dRILOQxheHxD
                                                                                                                                                                                                                      MD5:389A85E60B7DA2F29AAA738A7BF2B542
                                                                                                                                                                                                                      SHA1:4C6F51FD4C25F22474667AB8078AD974A9628C5D
                                                                                                                                                                                                                      SHA-256:8A703DA286CDBC263FE28D0888C03BB899E73B4B7729C44A953CC6139F33E3BE
                                                                                                                                                                                                                      SHA-512:898506A70DA25E8D181DF7E7790430ABEFCB0C9EECCB0595A1983CE09B6155DD0C72935470FBB9EF0BFA0BFFC953555693FF2FFA2461C10B84578691CD0C7B50
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7@..s!.]s!.]s!.]zY.]u!.]!T.\q!.].Ny]r!.]!T.\.!.]!T.\y!.]!T.\r!.].T.\v!.]8Y.\q!.]s!.].!.].T.\z!.].T.\r!.].T{]r!.].T.\r!.]Richs!.]........PE..L.....,d...........!.........n.......................................................I....@.........................P...P................................/......8.......T...............................@............................................text....~.......................... ..`.rdata...E.......F..................@..@.data...L...........................@....rsrc...............................@..@.reloc..8...........................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\_ssl.pyd

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):141592
                                                                                                                                                                                                                      Entropy (8bit):6.519132347042123
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:Q1ixmpACRnjX8bpl/u3O90wxY77N5ILC792oywBxv:4ixmpPsbppu3zwxWN9b
                                                                                                                                                                                                                      MD5:1222DAA5C49F53A36D2843CA9BFE513A
                                                                                                                                                                                                                      SHA1:7A43E326B261E75A05CDFA979B80E95B69080173
                                                                                                                                                                                                                      SHA-256:69C76B8FE5C873D1A0DFF493C3A3B88090B61EE648AD7681BC0581964465589E
                                                                                                                                                                                                                      SHA-512:B5BF384D14C3C8221A42288F97D910491730C84BE0A783F5BD17FC2E3DF7F2BB63529571C97CB08064066AA90F07FA00C837944E43DB62E071089A720A8BB551
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_...>...>...>...F-..>...K...>...K...>...K...>...K...>..=K...>..8B...>...>..r?...F...>..=K...>..=K...>..=KA..>..=K...>..Rich.>..........................PE..L...~.,d...........!.........L......t........................................ .......P....@..........................q..d...4r.........................../..........Pm..T............................m..@...............,............................text............................... ..`.rdata..............................@..@.data....J.......H..................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\_uuid.pyd

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):22808
                                                                                                                                                                                                                      Entropy (8bit):6.937211239543495
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:vqIesePwjnE8Gtr5ILZwkeHQIYiSy1pCQiI/NPxh8E9VF0Nyn54qSc:CIeZkgr5ILZwkU5YiSyvT/NPxWElQc
                                                                                                                                                                                                                      MD5:59F19A807B3E13D8E707C942A38BF84E
                                                                                                                                                                                                                      SHA1:469DEC6DA89737795C72FF51F69B44462E55099A
                                                                                                                                                                                                                      SHA-256:7ED17311B391FFFF58F073ECF71829F73629033458A54A435DC62014281A733C
                                                                                                                                                                                                                      SHA-512:3C10A7B3AF03E1AE95C577FB4FEE108D0ACFF876DFE0FD1079F74DE30881B5F3659AAA1F52A857CEC9C7430248094E896261C297A25C62D4951252A3A74EB48A
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[..:...:...:...B'..:...O...:...O...:...O...:...O...:...O...:...B...:...:...:...O...:...O...:...OK..:...O...:..Rich.:..................PE..L...M.,d...........!......................... ...............................`......5.....@..........................%..L....%..x....@...............*.../...P..l.... ..T...........................H!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc..l....P.......(..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\base_library.zip

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1066352
                                                                                                                                                                                                                      Entropy (8bit):5.6712348464357385
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12288:cgYJu4KXWyBC6S4IE/8A4a2YaRxdOVwx/fpEh+rg3u+E0SLMNJ:cgYJiVB+La2xkVwx/fpEh+Iu+E/MNJ
                                                                                                                                                                                                                      MD5:F2462FAB571A87A8C1884B186CCCAB73
                                                                                                                                                                                                                      SHA1:13022B2FA4F83EC218E024A85E97454D8DCA2385
                                                                                                                                                                                                                      SHA-256:4872929FFBAF2FC9F0598DB66B6FEA94EFC58960CA6AFBB1A82EA1E518830991
                                                                                                                                                                                                                      SHA-512:B43FB2A80057B86DD4E58D86C7F69373259DC0DD76E21FAA3B23E38226CBCBF5D023CB45BE8E7591210BD96816136B21C12FBD870DFE57E1933C22F171F774C1
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:PK..........!..,..5...5......._collections_abc.pyco....................................@.......d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.e.e.e.....Z.e.d...Z.d.d...Z.e.e...Z.[.g.d...Z.d.Z.e.e.d.....Z.e.e.e.......Z.e.e.i.........Z.e.e.i.........Z.e.e.i.........Z.e.e.g.....Z.e.e.e.g.......Z.e.e.e.d.......Z.e.e.e.d.d.>.......Z.e.e.e.......Z.e.e.d.....Z e.e.d.....Z!e.e.e"......Z#e.i.......Z$e.i.......Z%e.i.......Z&e.e.j'..Z(e.d.d.......Z)d.d...Z*e*..Z*e.e*..Z+e*.,....[*d.d...Z-e-..Z-e.e-..Z.[-d.d...Z/G.d.d...d.e.d...Z0G.d.d...d.e.d...Z1G.d.d...d.e1..Z2e2.3e+....G.d.d...d.e.d...Z4G.d.d ..d e4..Z5G.d!d"..d"e5..Z6e6.3e.....G.d#d$..d$e.d...Z7G.d%d&..d&e7..Z8e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e ....e8.3e!....e8.3e#....G.d'd(..d(e7..Z9G.d)d*..d*e8..Z:e:.3e)....G.d+d,..d,e.d...Z;G.d-d...d.e.d...Z<G.d/d0..d0e;e7e<..Z=G.d1d2..d2e...Z>d3d4..Z?d5d6..Z@d7d8..ZAG.d9d:..d:e.d...ZBG.d;d<..d<e=..ZCeC.3eD....G.d=d>..d>eC..ZEeE.3e.....G.d?d@..d@e=..ZFeF

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\bitbox02\communication\generated\backup_commands_pb2.pyi

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3851
                                                                                                                                                                                                                      Entropy (8bit):4.982326391283038
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:OxkNmfIDg1E8zcwkGOIV9WdkgrRhYLVBHrJPIV88grwSzK:TgQsa84wPV9WdPrRhKVtrJAV8HrwSzK
                                                                                                                                                                                                                      MD5:6988EF78588BD0E8209E9CC8B5D342E3
                                                                                                                                                                                                                      SHA1:1533EEA95F7D228D6BC2E9E594ACF83119A79666
                                                                                                                                                                                                                      SHA-256:413EEC4E1B878D16DFC846D7164DD016253F9F30EECE914809D2E23EB66F2355
                                                                                                                                                                                                                      SHA-512:B236DF28460E052B10717250D151F13F781DFA24B0FB8178D6CCD1CAFD91419CB4EE355F1B1FA9164CA103EC281C0F66CA3FD365CD13B469F1D200EDCE440774
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:""".@generated by mypy-protobuf. Do not edit manually!.isort:skip_file.""".import builtins.import google.protobuf.descriptor.import google.protobuf.internal.containers.import google.protobuf.message.import typing.import typing_extensions..DESCRIPTOR: google.protobuf.descriptor.FileDescriptor..class CheckBackupRequest(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor. SILENT_FIELD_NUMBER: builtins.int. silent: builtins.bool. def __init__(self,. *,. silent: builtins.bool = ...,. ) -> None: .... def ClearField(self, field_name: typing_extensions.Literal["silent",b"silent"]) -> None: ....global___CheckBackupRequest = CheckBackupRequest..class CheckBackupResponse(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor. ID_FIELD_NUMBER: builtins.int. id: typing.Text. def __init__(self,. *,. id: typing.Text = ...,. ) -> None: .... def ClearField(self, field_

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\bitbox02\communication\generated\bitbox02_system_pb2.pyi

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable, with very long lines (309)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5248
                                                                                                                                                                                                                      Entropy (8bit):5.0699310653475695
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:nGkV76NTnaQGpXW/CEI569BaWei1Am0d3gGI4Dzl+iG/hiV0XW9zeasQjjV:d54ja5W/BI569uiCZd3lzgzY2W961EjV
                                                                                                                                                                                                                      MD5:A17DDB62F276DBB561B515918DDC95EB
                                                                                                                                                                                                                      SHA1:63370BA2A706796E779CAA3C6534B09F5684F002
                                                                                                                                                                                                                      SHA-256:54D2D6921A78180D974870386EC4E9C6F0F50CDD7B3C0C5B3D8E88615A760FFA
                                                                                                                                                                                                                      SHA-512:83819E50975DA79B483B6240BCBC5F0E5CE2C1A44794D48A4C3225A4801205104A2EE207F5ABC86D571DA76D32C7D9E07722820064C658543A8DBB8DB7FC5D1D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:""".@generated by mypy-protobuf. Do not edit manually!.isort:skip_file.""".import builtins.import google.protobuf.descriptor.import google.protobuf.internal.enum_type_wrapper.import google.protobuf.message.import typing.import typing_extensions..DESCRIPTOR: google.protobuf.descriptor.FileDescriptor..class CheckSDCardRequest(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor. def __init__(self,. ) -> None: ....global___CheckSDCardRequest = CheckSDCardRequest..class CheckSDCardResponse(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor. INSERTED_FIELD_NUMBER: builtins.int. inserted: builtins.bool. def __init__(self,. *,. inserted: builtins.bool = ...,. ) -> None: .... def ClearField(self, field_name: typing_extensions.Literal["inserted",b"inserted"]) -> None: ....global___CheckSDCardResponse = CheckSDCardResponse..class DeviceInfoRequest(google.protobuf.message.Message):.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\bitbox02\communication\generated\btc_pb2.pyi

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable, with very long lines (388)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):33375
                                                                                                                                                                                                                      Entropy (8bit):5.136269727408597
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:2FSyf8CT3THDKoTScSFPNG730gzFNsdlXMM87Uqu9qmjv/Lqr2XE58TS6fFyHTST:2FSyf8CT3THDKoTScSFPNG730gzFNsd7
                                                                                                                                                                                                                      MD5:AA42E66D765C8193D5E21F3FBC96992B
                                                                                                                                                                                                                      SHA1:E368061C6A2401DB353624402C71A4D1CF3D8668
                                                                                                                                                                                                                      SHA-256:7616DB88EBC403644E3ADFDE37ACBA44FC3EEB881E07838F82FC1A89B480A8BE
                                                                                                                                                                                                                      SHA-512:5161DF99A69710C2A827024E7D8C1F26BD0D94ED56865C4E2030DF2C46912227F1DD1DB94E53CFE065DE9E4843C2AEFF019299D46D702B245A31D0705327BEE9
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:""".@generated by mypy-protobuf. Do not edit manually!.isort:skip_file.""".from . import antiklepto_pb2.import builtins.from . import common_pb2.import google.protobuf.descriptor.import google.protobuf.internal.containers.import google.protobuf.internal.enum_type_wrapper.import google.protobuf.message.import typing.import typing_extensions..DESCRIPTOR: google.protobuf.descriptor.FileDescriptor..class _BTCCoin:. ValueType = typing.NewType('ValueType', builtins.int). V: typing_extensions.TypeAlias = ValueType.class _BTCCoinEnumTypeWrapper(google.protobuf.internal.enum_type_wrapper._EnumTypeWrapper[_BTCCoin.ValueType], builtins.type):. DESCRIPTOR: google.protobuf.descriptor.EnumDescriptor. BTC: _BTCCoin.ValueType # 0. TBTC: _BTCCoin.ValueType # 1. LTC: _BTCCoin.ValueType # 2. TLTC: _BTCCoin.ValueType # 3.class BTCCoin(_BTCCoin, metaclass=_BTCCoinEnumTypeWrapper):. pass..BTC: BTCCoin.ValueType # 0.TBTC: BTCCoin.ValueType # 1.LTC: BTCCoin.ValueType # 2.TLTC:

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\bitbox02\communication\generated\common_pb2.pyi

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3152
                                                                                                                                                                                                                      Entropy (8bit):4.9931742238287145
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:OKX8xO9Ie9coB87F8qDO4LyBcjhmlP7OpOhONOPONpNpBwBG5eBKBcwqRqaaZ+3q:OC6JadBGFD5+nlDoycKGvwGcWBmzvPsB
                                                                                                                                                                                                                      MD5:475776E2B63777A766E1121F4E7F0DA2
                                                                                                                                                                                                                      SHA1:C393E11514C2CA8DEFE5B102AB89D5ED344DDC52
                                                                                                                                                                                                                      SHA-256:A81614BF23A09597C6CA2F96EAC36BE27F65FF743E872919F45E7440DD367F45
                                                                                                                                                                                                                      SHA-512:668D76C46827E0D2E308C92E29AB3049B5B0738463836F4BC0A18CA44605D3A75EFABA97160B522644F1BDCA4CC5EE4E58E4CC09870E6ACD1F8AACD8D2AB2BF8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:""".@generated by mypy-protobuf. Do not edit manually!.isort:skip_file.""".import builtins.import google.protobuf.descriptor.import google.protobuf.internal.containers.import google.protobuf.message.import typing.import typing_extensions..DESCRIPTOR: google.protobuf.descriptor.FileDescriptor..class PubResponse(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor. PUB_FIELD_NUMBER: builtins.int. pub: typing.Text. def __init__(self,. *,. pub: typing.Text = ...,. ) -> None: .... def ClearField(self, field_name: typing_extensions.Literal["pub",b"pub"]) -> None: ....global___PubResponse = PubResponse..class RootFingerprintRequest(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor. def __init__(self,. ) -> None: ....global___RootFingerprintRequest = RootFingerprintRequest..class RootFingerprintResponse(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\bitbox02\communication\generated\eth_pb2.pyi

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable, with very long lines (309)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):19589
                                                                                                                                                                                                                      Entropy (8bit):5.09832628113467
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:YA1AbKmuBTqCcKEn6u6T86uwORnAJR5vbPbTSV6s6oi7+J5JsRtHy:YWAbKmuBTqCcKEn6u6T86uwORnAJR5vw
                                                                                                                                                                                                                      MD5:1D34C55C7121BD3695CFC6C73381DC0C
                                                                                                                                                                                                                      SHA1:1AB53605573FA267FD457B284AEC6507D7C40857
                                                                                                                                                                                                                      SHA-256:E45729EF836A6202048AF41997D058846959ED9CA705E434BE6760313E7EF64A
                                                                                                                                                                                                                      SHA-512:590DB0ECABA1470D60710649E363E49D8496EA205BBE2E522D788BBB288916740D86D68C44ECAD83B00C985F28B74604E3A430E879694727CE909ED278824710
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:""".@generated by mypy-protobuf. Do not edit manually!.isort:skip_file.""".from . import antiklepto_pb2.import builtins.from . import common_pb2.import google.protobuf.descriptor.import google.protobuf.internal.containers.import google.protobuf.internal.enum_type_wrapper.import google.protobuf.message.import typing.import typing_extensions..DESCRIPTOR: google.protobuf.descriptor.FileDescriptor..class _ETHCoin:. ValueType = typing.NewType('ValueType', builtins.int). V: typing_extensions.TypeAlias = ValueType.class _ETHCoinEnumTypeWrapper(google.protobuf.internal.enum_type_wrapper._EnumTypeWrapper[_ETHCoin.ValueType], builtins.type):. DESCRIPTOR: google.protobuf.descriptor.EnumDescriptor. ETH: _ETHCoin.ValueType # 0. RopstenETH: _ETHCoin.ValueType # 1. """Removed in v9.14.0 - deprecated""".. RinkebyETH: _ETHCoin.ValueType # 2. """Removed in v9.14.0 - deprecated"""..class ETHCoin(_ETHCoin, metaclass=_ETHCoinEnumTypeWrapper):. """Kept for backwards compatibil

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\bitbox02\communication\generated\hww_pb2.pyi

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable, with very long lines (926)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):13514
                                                                                                                                                                                                                      Entropy (8bit):5.139264229998885
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:Gqw/WO8nXG7KgysmifAs21OgFNwnyGmGAWHWq4atFxxuxhc+cNfSv8YisYFDGcCu:Gqw/WO8XG7KgysmifAs21OgFNwyGmGAK
                                                                                                                                                                                                                      MD5:1F4404FED86A2D3B1052A995C06B1DAC
                                                                                                                                                                                                                      SHA1:548F5125246006890A6D2CAB0B9AFB09ABBCADAB
                                                                                                                                                                                                                      SHA-256:B7D6EA2DBFA9FB758ECD6F0D90ECA2878AAFB23503E4791F0D7077457CE89A46
                                                                                                                                                                                                                      SHA-512:2BC7B255562628C0FCF364DAE38C89C88EC25680CF1B5A7EDD52C0F89747B5863F4946DC3467EF62154586D0CC46AFFB8840765C9B33A338C6F742E56EA5F2C7
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:""".@generated by mypy-protobuf. Do not edit manually!.isort:skip_file.""".from . import backup_commands_pb2.from . import bitbox02_system_pb2.from . import btc_pb2.import builtins.from . import cardano_pb2.from . import common_pb2.from . import eth_pb2.import google.protobuf.descriptor.import google.protobuf.message.from . import keystore_pb2.from . import mnemonic_pb2.from . import perform_attestation_pb2.from . import system_pb2.import typing.import typing_extensions..DESCRIPTOR: google.protobuf.descriptor.FileDescriptor..class Error(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor. CODE_FIELD_NUMBER: builtins.int. MESSAGE_FIELD_NUMBER: builtins.int. code: builtins.int. message: typing.Text. def __init__(self,. *,. code: builtins.int = ...,. message: typing.Text = ...,. ) -> None: .... def ClearField(self, field_name: typing_extensions.Literal["code",b"code","message",b"message"]) -> None: ....glob

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\bitbox02\communication\generated\keystore_pb2.pyi

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1308
                                                                                                                                                                                                                      Entropy (8bit):4.960417044026867
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:kGrF3aHNKtG1rZ4ntdmZBEOdAMkFLJAYMcXCQ/iMdmZBpOjSAlTcXQixiTn:OKf8EOZ6sciY8pOWyclET
                                                                                                                                                                                                                      MD5:7926D8BDCCFEA930CBD2A2FB28298C9F
                                                                                                                                                                                                                      SHA1:6139C9CD1F56BE76C6E1DEE73079BA22696AFBBC
                                                                                                                                                                                                                      SHA-256:AB23047FFF35ED2B7FAE0283375992BE60D501CB3F0B0053CB97770FE31543E9
                                                                                                                                                                                                                      SHA-512:4A28958F6165C860382BD9491E461E3A11DACBEFD84D269602DDA0FE1D920EF7325E44B1265A13A87793C66AF325E1F4B416B6364B72D35A34B8CEA7DE79C18E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:""".@generated by mypy-protobuf. Do not edit manually!.isort:skip_file.""".import builtins.import google.protobuf.descriptor.import google.protobuf.internal.containers.import google.protobuf.message.import typing.import typing_extensions..DESCRIPTOR: google.protobuf.descriptor.FileDescriptor..class ElectrumEncryptionKeyRequest(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor. KEYPATH_FIELD_NUMBER: builtins.int. @property. def keypath(self) -> google.protobuf.internal.containers.RepeatedScalarFieldContainer[builtins.int]: .... def __init__(self,. *,. keypath: typing.Optional[typing.Iterable[builtins.int]] = ...,. ) -> None: .... def ClearField(self, field_name: typing_extensions.Literal["keypath",b"keypath"]) -> None: ....global___ElectrumEncryptionKeyRequest = ElectrumEncryptionKeyRequest..class ElectrumEncryptionKeyResponse(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\bitbox02\communication\generated\mnemonic_pb2.pyi

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1541
                                                                                                                                                                                                                      Entropy (8bit):4.953918413828606
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:kGrF3ayGrZ4TdmZB7AmdmZBkOXOavzRAwUwcXVZ1vThz1dmZB/OE17AS0cXQz0zy:9x87L8kOXOwzRcwcRR8/OEZB0ca
                                                                                                                                                                                                                      MD5:878BA6A31A34C344BFC3D7F916C21857
                                                                                                                                                                                                                      SHA1:9E56171DDCAB1412974020AF7ADEDA116D327A8C
                                                                                                                                                                                                                      SHA-256:22EBFAA989850D8A759F23304D66BF975C15D9CD0B8CD59EEAFA01A2A474DA72
                                                                                                                                                                                                                      SHA-512:DD20C9446B1B6A4B72668DBE563D21932745026CB1AB553E1E568FF6C0E5526E4EB9338136CB3D72EE46DA7D98F117D721FF2D5F490FD857CB81232B4AB8E4AD
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:""".@generated by mypy-protobuf. Do not edit manually!.isort:skip_file.""".import builtins.import google.protobuf.descriptor.import google.protobuf.message.import typing_extensions..DESCRIPTOR: google.protobuf.descriptor.FileDescriptor..class ShowMnemonicRequest(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor. def __init__(self,. ) -> None: ....global___ShowMnemonicRequest = ShowMnemonicRequest..class RestoreFromMnemonicRequest(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor. TIMESTAMP_FIELD_NUMBER: builtins.int. TIMEZONE_OFFSET_FIELD_NUMBER: builtins.int. timestamp: builtins.int. timezone_offset: builtins.int. def __init__(self,. *,. timestamp: builtins.int = ...,. timezone_offset: builtins.int = ...,. ) -> None: .... def ClearField(self, field_name: typing_extensions.Literal["timestamp",b"timestamp","timezone_offset",b"timezone_offset"]) -> None: ..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\bitbox02\communication\generated\perform_attestation_pb2.pyi

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1990
                                                                                                                                                                                                                      Entropy (8bit):5.024193639757406
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:9VwDXOi+69BcnVwYOB/OzOVOOOvYjMB63BxKBlMpBUBfBcSckUw:PAjT+Vn20YRkKw6x8lQE5PUw
                                                                                                                                                                                                                      MD5:FA9B13FCDE2A27D056BDCF511923EC4F
                                                                                                                                                                                                                      SHA1:DF9598AAFFF3BCB14870D8BB5B155B23687C1E17
                                                                                                                                                                                                                      SHA-256:7B6C5A3996BFFDFFF9C224FC332635A9D4B9F29D730AF6A3983DAA14123DE79C
                                                                                                                                                                                                                      SHA-512:1D5C9C4A6B43B440079950BDFBA539D7E980202CB4E34F66160EF56FD39A8F3CD3219EC0087469C9B1F7D38CFD8C5D22E1D1C27F71419EE33962307CFFFD4B24
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:""".@generated by mypy-protobuf. Do not edit manually!.isort:skip_file.""".import builtins.import google.protobuf.descriptor.import google.protobuf.message.import typing_extensions..DESCRIPTOR: google.protobuf.descriptor.FileDescriptor..class PerformAttestationRequest(google.protobuf.message.Message):. """Deprecated, last used in v1.0.0""". DESCRIPTOR: google.protobuf.descriptor.Descriptor. CHALLENGE_FIELD_NUMBER: builtins.int. challenge: builtins.bytes. """32 bytes challenge.""".. def __init__(self,. *,. challenge: builtins.bytes = ...,. ) -> None: .... def ClearField(self, field_name: typing_extensions.Literal["challenge",b"challenge"]) -> None: ....global___PerformAttestationRequest = PerformAttestationRequest..class PerformAttestationResponse(google.protobuf.message.Message):. """Deprecated, last used in v1.0.0""". DESCRIPTOR: google.protobuf.descriptor.Descriptor. BOOTLOADER_HASH_FIELD_NUMBER: builtins.int. DEVICE_PUBKEY_FIELD

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\bitbox02\communication\generated\system_pb2.pyi

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1394
                                                                                                                                                                                                                      Entropy (8bit):4.908402032806933
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:kGrF3aHkG1rZ426dmZBR7FYC9Mfuva/N7SOxa2cC2ZhUn6W/rWC+u6WQDOJVYAHx:NN8R7eX7SnITn6YWC+u6DO06cx2
                                                                                                                                                                                                                      MD5:D283654C86077E18CD61D581C02894F4
                                                                                                                                                                                                                      SHA1:2AFF38170C43FF33480D80A93D47094E4258160B
                                                                                                                                                                                                                      SHA-256:C8AA69CC36271BBF0ECBC5947F10169E97AC65624B244D4D19BFD68E78427CB3
                                                                                                                                                                                                                      SHA-512:456927D2F2FD5495E04133BA8E89BAC36BC03250BC5BD2AA828642D574BF474A62D77F16E0EF9280C3A3A5FCCEC2835D912EAB02FB79F82C8563753766F4A2EF
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:""".@generated by mypy-protobuf. Do not edit manually!.isort:skip_file.""".import builtins.import google.protobuf.descriptor.import google.protobuf.internal.enum_type_wrapper.import google.protobuf.message.import typing.import typing_extensions..DESCRIPTOR: google.protobuf.descriptor.FileDescriptor..class RebootRequest(google.protobuf.message.Message):. DESCRIPTOR: google.protobuf.descriptor.Descriptor. class _Purpose:. ValueType = typing.NewType('ValueType', builtins.int). V: typing_extensions.TypeAlias = ValueType. class _PurposeEnumTypeWrapper(google.protobuf.internal.enum_type_wrapper._EnumTypeWrapper[RebootRequest._Purpose.ValueType], builtins.type):. DESCRIPTOR: google.protobuf.descriptor.EnumDescriptor. UPGRADE: RebootRequest._Purpose.ValueType # 0. SETTINGS: RebootRequest._Purpose.ValueType # 1. class Purpose(_Purpose, metaclass=_PurposeEnumTypeWrapper):. pass.. UPGRADE: RebootRequest.Purpose.ValueType # 0. SETTING

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\certifi\cacert.pem

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):292541
                                                                                                                                                                                                                      Entropy (8bit):6.048162209044241
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/Q5MSRqNb7d8iu5NF:QWb/TRJLWURrI55MWavdF0D
                                                                                                                                                                                                                      MD5:D3E74C9D33719C8AB162BAA4AE743B27
                                                                                                                                                                                                                      SHA1:EE32F2CCD4BC56CA68441A02BF33E32DC6205C2B
                                                                                                                                                                                                                      SHA-256:7A347CA8FEF6E29F82B6E4785355A6635C17FA755E0940F65F15AA8FC7BD7F92
                                                                                                                                                                                                                      SHA-512:E0FB35D6901A6DEBBF48A0655E2AA1040700EB5166E732AE2617E89EF5E6869E8DDD5C7875FA83F31D447D4ABC3DB14BFFD29600C9AF725D9B03F03363469B4C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\cryptography\hazmat\bindings\_rust.pyd

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5105664
                                                                                                                                                                                                                      Entropy (8bit):6.747499713859597
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:49152:rHWs7jO0dKPCZL/CIpNsIf0HszAwDrvibENUffZi97n8gKdDoRSkET7pmfi+zfJg:rHW0OtCZL/C3HsrDibE+fOOouT4qnB
                                                                                                                                                                                                                      MD5:871133E95B9704B35E6192C136949520
                                                                                                                                                                                                                      SHA1:B6D0BA578A1CFABB5CCB4169250BB58910984568
                                                                                                                                                                                                                      SHA-256:8D33F22574E8778C21BD7F395FABDCC996F3E22E91CF0489298499884C88BC91
                                                                                                                                                                                                                      SHA-512:8DFF4837C8F73090E45927D61FCAF25E7D2DDD20EE29612CA94CFD62E80679EDCF1607B448719121B2ACB1BF55A5C6C9F20E1A9FF9A0D2011B7B1669E83FF3D8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.......................................................-...........5.........-...e...x...............x.......x.......Rich............................PE..L....f.e.........."!...&.0=.........;.<......@=..............................0N...........@.........................`aJ.p....aJ.|............................@K.......H.T.....................H.....0.H.@............@=.h............................text.....=......0=................. ..`.rdata..XA...@=..B...4=.............@..@.data........J......vJ.............@....reloc.......@K.......K.............@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\bip39_wallet_formats.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3308
                                                                                                                                                                                                                      Entropy (8bit):4.46082568411814
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:EHtrrarfTWeeWxbexSb6mtD2+8+PTWIDVjrTTte+g:zm
                                                                                                                                                                                                                      MD5:46CA7C7E51E5F0604DEACF218A0F50E8
                                                                                                                                                                                                                      SHA1:9BB4D19739AB70AD29ED7F94F672B167E7A1CE53
                                                                                                                                                                                                                      SHA-256:1C5215598A86EFB728754270A91076B653A14D7EAE33BE25C7DE02405E4F329B
                                                                                                                                                                                                                      SHA-512:C3D64329EEA3B6024E9D0C0241AF88E53A00E32D8BC3E86C5835ED0120294655C1753ECEC8037559CC59D0E42C13E2FE025ED0FA57F04F7A0DD39476A28ED5FC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:[. {. "description": "Standard BIP44 legacy",. "derivation_path": "m/44'/0'/0'",. "script_type": "p2pkh",. "iterate_accounts": true. },. {. "description": "Standard BIP49 compatibility segwit",. "derivation_path": "m/49'/0'/0'",. "script_type": "p2wpkh-p2sh",. "iterate_accounts": true. },. {. "description": "Standard BIP84 native segwit",. "derivation_path": "m/84'/0'/0'",. "script_type": "p2wpkh",. "iterate_accounts": true. },. {. "description": "Non-standard legacy",. "derivation_path": "m/0'",. "script_type": "p2pkh",. "iterate_accounts": true. },. {. "description": "Non-standard compatibility segwit",. "derivation_path": "m/0'",. "script_type": "p2wpkh-p2sh",. "iterate_accounts": true. },. {. "description": "Non-standard native segwit",. "derivation_path": "m/0'",. "script_type": "p2wpkh",.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\checkpoints.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):64346
                                                                                                                                                                                                                      Entropy (8bit):3.988903542144095
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:gvjv9+0ZVWQgy2x8zlOcG3aqGS5ylztlHxNG:2C8YYpPK
                                                                                                                                                                                                                      MD5:703CA84845B0C307013DB29969CB2386
                                                                                                                                                                                                                      SHA1:2D59680ADBE5755F62AC5BE7C4CD45BBCF75091E
                                                                                                                                                                                                                      SHA-256:13E9905FFAAB7827AFBBDEBC184CCEDFAA2B34772C2D5191F2707326FB8A6DEA
                                                                                                                                                                                                                      SHA-512:0C9C677BE2AA3288CC7DC193712A89866B0C2BE27ACB71EF2AE26D902870F111E84DA152CA0FEB29EEAEDB5D943CAACEE1F899ADD62892CD5853940E75473A3D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:[. [. "00000000693067b0e6b440bc51450b9f3850561b07f6d3c021c54fbd6abb9763",. 26959535291011309493156476344723991336010898738574164086137773096960. ],. [. "00000000f037ad09d0b05ee66b8c1da83030abaf909d2b1bf519c3c7d2cd3fdf",. 26959535291011309493156476344723991336010898738574164086137773096960. ],. [. "000000006ce8b5f16fcedde13acbc9641baa1c67734f177d770a4069c06c9de8",. 26959535291011309493156476344723991336010898738574164086137773096960. ],. [. "00000000563298de120522b5ae17da21aaae02eee2d7fcb5be65d9224dbd601c",. 26959535291011309493156476344723991336010898738574164086137773096960. ],. [. "000000009b0a4b2833b4a0aa61171ee75b8eb301ac45a18713795a72e461a946",. 26959535291011309493156476344723991336010898738574164086137773096960. ],. [. "00000000fa8a7363e8f6fdc88ec55edf264c9c7b31268c26e497a4587c750584",. 26959535291011309493156476344723991336010898738574164086137773096960. ],.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\checkpoints_testnet.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):126425
                                                                                                                                                                                                                      Entropy (8bit):3.922155501299977
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:wTfJux0vjeByZDtPsfCNOXcrFasvJa+tngIce4CHIyZjbfHTJr13W:k5ScZaCNTrF3ngXUjrFr13W
                                                                                                                                                                                                                      MD5:8A4AE1706FBDEADED3D4D80164BBA0E5
                                                                                                                                                                                                                      SHA1:FDA0E92ADED3CEA8544083BC980DCB2723F33A91
                                                                                                                                                                                                                      SHA-256:C7C7B34C03443EB97AB543E0FB76ECBDF20F546DED70F60CFC2A5AAC17B8999B
                                                                                                                                                                                                                      SHA-512:F7E981BCAEBD7A7C39960118A7206BD6642AA89594939C33FAD26E9B4AAC8994E15E24BE972BC79D4F39ECBCB1D104D5C8C7167BD7CF885DFD807DA59660A6CD
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:[. [. "00000000864b744c5025331036aa4a16e9ed1cbb362908c625272150fa059b29",. 0. ],. [. "000000002e9ccffc999166ccf8d72129e1b2e9c754f6c90ad2f77cab0d9fb4c7",. 0. ],. [. "0000000009b9f0436a9c733e2c9a9d9c8fe3475d383bdc1beb7bfa995f90be70",. 0. ],. [. "000000000a9c9c79f246042b9e2819822287f2be7cd6487aecf7afab6a88bed5",. 0. ],. [. "000000003a7002e1247b0008cba36cd46f57cd7ce56ac9d9dc5644265064df09",. 0. ],. [. "00000000061e01e82afff6e7aaea4eb841b78cc0eed3af11f6706b14471fa9c8",. 0. ],. [. "000000003911e011ae2459e44d4581ac69ba703fb26e1421529bd326c538f12d",. 0. ],. [. "000000000a5984d6c73396fe40de392935f5fc2a8e48eedf38034ce0a3178a60",. 0. ],. [. "000000000786bdc642fa54c0a791d58b732ed5676516fffaeca04492be97c243",. 0. ],. [. "000000001359c49f9618f3ee69afbd1b3196f1832acc47557d42256fcc6b7f48",. 0. ],. [.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\currencies.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):13589
                                                                                                                                                                                                                      Entropy (8bit):2.9049133687933306
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:07m8rWrq9bzab8rbWrqu6jWBhd8rWrq3/8rno8rbWr7b8rf:0xza5POy
                                                                                                                                                                                                                      MD5:98F790C46325F2663FB8C4301A762FA2
                                                                                                                                                                                                                      SHA1:00E1F57575A71C4FE1972DC1A08600399AB936D5
                                                                                                                                                                                                                      SHA-256:608DEEDC9FA24701E9D1AA834B231CB8DB6EC014FE03353BD589D6BB6B82AF39
                                                                                                                                                                                                                      SHA-512:B13C175C92C6096BA6360485E378EE030FBC8FAFF525896D3D3445EDCD91120EAAD1C343DAE756C82C641CE80344456AB8248710035AD86132AEA5F9E6B3CDF2
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{. "BitFlyer": [. "JPY". ],. "Bit2C": [. "ILS". ],. "BitPay": [. "AED",. "AFN",. "ALL",. "AMD",. "ANG",. "AOA",. "ARS",. "AUD",. "AWG",. "AZN",. "BAM",. "BBD",. "BCH",. "BDT",. "BGN",. "BHD",. "BIF",. "BMD",. "BND",. "BOB",. "BRL",. "BSD",. "BTC",. "BTN",. "BWP",. "BZD",. "CAD",. "CDF",. "CHF",. "CLF",. "CLP",. "CNY",. "COP",. "CRC",. "CUP",. "CVE",. "CZK",. "DJF",. "DKK",. "DOP",. "DZD",. "EGP",. "ETB",. "EUR",. "FJD",. "FKP",. "GBP",. "GEL",. "GHS",. "GIP",. "GMD",. "GNF",. "GTQ",. "GYD",. "HKD",. "HNL",. "HRK",. "HTG",. "HUF",. "IDR",.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\Electrum_512.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):174386
                                                                                                                                                                                                                      Entropy (8bit):7.968500119111208
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:m4EU4nvqLgn2cQtfeafQuJt5ioqmfdXV11gMdHtTeu:Mvqk2T/Jt5ioLf1V11gMJ8u
                                                                                                                                                                                                                      MD5:86B79DFCB64DE8DDFFDAF1BED393C9A6
                                                                                                                                                                                                                      SHA1:C78609FFB571BA419CA1D869BD03CE8A3834B03B
                                                                                                                                                                                                                      SHA-256:9E68B49C2AA7E6FBF7F456CE20B18BA98D6F85A0161DA240901D4A7DBA464CBD
                                                                                                                                                                                                                      SHA-512:B7CD296707FEE4B4C3A21989AC613D3994A2E60934372A22B903C0FE9E585CB1940F78DD8D4B93D2CC56BAB5F38908193E18BFA00514C1381B0DC9E4DC84BBB0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............x.....AiCCPICC Profile..H...wTS....7..." %..z. .;H..Q.I.P...&vD.F..)VdT..G."cE....b....P..QDE..k..5....Y.....g.}..P....tX..4.X....\..........X...ff.G.D....=...H.....d..,.P&s...."7C$...E.6<~&....S...2.....)2.12....."..l...+...&..Y...4...P.%...\.%.g.|.e.TI....(....L.0.._..&.l.2E.........9.r...9h..x.g...Ib...i...f..S.b1+..M.xL.....0...o.E.%Ym.h.....Y..h.....~S.=.z.U.&..A..Y.l./....$Z.....U..m.@..O. .........l^....'....ls..k.+.7...o..9.....V;..?.#I.3eE..KD......d......9i...,......UQ....h..<.X..d.......6'..~.k.hu_.}.9P.I..o=.C#.$n?z.}.[.1...h...s.2z.....\.n.LA"S....dr%.,...l.....t..4..0.,`...3p.. ...H.....H.i@..A>...A1..v.jp..z..N.6p.\.W..p...G@...K0..i......A......B...Z.yCAP8...C....@..&..*...CP=.#t...]..... 4...}.....a......;..G...Dx.......J..>........,._..@....FX...DB.X$..!k."...E.......H.q.....a......Y..bVa.bJ0.c.VL..6f.3....b..X'.?v.6...-.V`.`[.....a.;.......p~..\2n5...........&.x.*.....s.b|!.........'..Z.k..!. $l$T

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\Electrum_square_512.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):175987
                                                                                                                                                                                                                      Entropy (8bit):7.947889831396768
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:XXkxLtz/rdEk4jZOGVy/NuguOWsOe0kOYuUDDMCWfU6qbC52XC/PrI7lWt:kPY1KGOWhe0kOcDDTqPq+5NI6
                                                                                                                                                                                                                      MD5:843B877B6083178C37566EB49012D518
                                                                                                                                                                                                                      SHA1:3D30E35B39687DF2914EABC70857A986C13D9ADC
                                                                                                                                                                                                                      SHA-256:780A4BF68902A306C2CE24B8424F68BA91875D99D13EC8A2CF05AAAFA9B23624
                                                                                                                                                                                                                      SHA-512:C8AA04DFADCE3E34F0B2D00762854E04EF65BC6311058B18B0ECD6DDE6130E004A8626498EF5D21ED8C30C26C685D9CD21CD37BC281A79E16ACEB52AA037763A
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............x.....AiCCPICC Profile..H...wTS....7..." %..z. .;H..Q.I.P...&vD.F..)VdT..G."cE....b....P..QDE..k..5....Y.....g.}..P....tX..4.X....\..........X...ff.G.D....=...H.....d..,.P&s...."7C$...E.6<~&....S...2.....)2.12....."..l...+...&..Y...4...P.%...\.%.g.|.e.TI....(....L.0.._..&.l.2E.........9.r...9h..x.g...Ib...i...f..S.b1+..M.xL.....0...o.E.%Ym.h.....Y..h.....~S.=.z.U.&..A..Y.l./....$Z.....U..m.@..O. .........l^....'....ls..k.+.7...o..9.....V;..?.#I.3eE..KD......d......9i...,......UQ....h..<.X..d.......6'..~.k.hu_.}.9P.I..o=.C#.$n?z.}.[.1...h...s.2z.....\.n.LA"S....dr%.,...l.....t..4..0.,`...3p.. ...H.....H.i@..A>...A1..v.jp..z..N.6p.\.W..p...G@...K0..i......A......B...Z.yCAP8...C....@..&..*...CP=.#t...]..... 4...}.....a......;..G...Dx.......J..>........,._..@....FX...DB.X$..!k."...E.......H.q.....a......Y..bVa.bJ0.c.VL..6f.3....b..X'.?v.6...-.V`.`[.....a.;.......p~..\2n5...........&.x.*.....s.b|!.........'..Z.k..!. $l$T

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\add.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):687
                                                                                                                                                                                                                      Entropy (8bit):7.377532436950315
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7JZEVEG9X6fWYJzggenHHHGadWUmvS7jx0HvgutsLK79DoQmRJV9HP8m:saVTAfwJHHH7cS/xKgtLYDon9Em
                                                                                                                                                                                                                      MD5:306C508E41649D8BFF7C7D8922AA8139
                                                                                                                                                                                                                      SHA1:3EBABCAF901ADED58811E88A45DD97CAA2060A2C
                                                                                                                                                                                                                      SHA-256:04D8CDA81A29DA1F0198FE8B2A6FA6537E5FF2F7124EBB61F0CAAC64710F253C
                                                                                                                                                                                                                      SHA-512:5D1AE05F95E8E59155AA6ADF4A8A6960206200C89F08C7F9D55E5643D08A92D0D26CF0F0290AE29C08F1A02D2CBED9B1093CBD424A0BEBB158B9DB1671554470
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...@...@......iq.....pHYs.........c......tEXtSoftware.www.inkscape.org..<....<IDATx..=..Q...3w.d.B....."....lk+..'..+......~....#.X.v6+..+.+Y&.c...n2W.r.8.@.9.y&.C.LDU.2.u.k\.u.k\.u.k\.u.k:/...Ln..D......d.E.H........da.R.............tx..p....:f.~..P.....m......`....`....`....`....`....`M......M...;(g.:.JA.U8...&..Py..._.........(=.......m@Q....~.5.r[Y..FK....`7-....}..?.....`."E.)........)...>......E..X..........+.....`<g1..X..RD....L..&,..KI..(z.w....|*..g(_b.Z.....r.:O..._..y..98..J...^@....*.H..;.NJ..J...L.>.x...o.."....X....X....X....X....X....X.y..o...t..'bs.d>..a..jD../...~.Ld...h.vq....M..$."........X....X....X..J.r.q..L....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\android_electrum_icon_background.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 432 x 432, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1349
                                                                                                                                                                                                                      Entropy (8bit):3.151366413748389
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPkVsCsyRYTZDn+sn+FsH+sH+sn+FscPsH+sn+FsH+sH+sl+sH+sn+FsH+sV:6v/7klBRYTZDJ
                                                                                                                                                                                                                      MD5:EB7D708191A38F982841DB110BDBBE89
                                                                                                                                                                                                                      SHA1:46D751BEDE5751B188B3227581ECCF959855300B
                                                                                                                                                                                                                      SHA-256:02A6F4521D0656103369D6CE3EAF7E314289B342F8B67DB00592A3C409ED6D80
                                                                                                                                                                                                                      SHA-512:B0A9C9F106BF2AE9AC57C30AC195669BFF31B32D86837FA9D61B48A2854E41277D7B4FA70545FF762F51FC703234383429086D35EAEFAD7B540F5E122440D7C4
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............N0*....IDATx...1.......7.*8Hz...U..<$...................``.``.``.``..............................``.``.``..............................``.``.``..............................``.``.``.``..............................``.``.``.....................``.``.``..............................``.``.``.``..............................``.``.``..............................``.``.``..............................``.``.``.``.....................``.``.``..............................``.``.``..............................``.``.``.``..............................``.``.``..............................``.``.``..................................``.``.``..............................``.``.``..............................``.``.``.``..............................``.``.``..............................``.``.``. ...................``.``.``.``..............................``.``.``..............................``.``.``..............................``.``.``.``..............................`

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\android_electrum_icon_foreground.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 432 x 432, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):23973
                                                                                                                                                                                                                      Entropy (8bit):7.9504694279167945
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:XkyL4VmLi000d3ui6AWxSLpFipUfWuyVTnl0+n25TT7D3LBwyZ56JwDcHMfG:0Ov+0NFui6AWleWVnO+n25TT/LeyiIX+
                                                                                                                                                                                                                      MD5:EC88544988E9C6E6147D5ED34D6A6792
                                                                                                                                                                                                                      SHA1:7C53FD17F58ECB44FEE4CFAC4D0420D1DF45D6C3
                                                                                                                                                                                                                      SHA-256:F53007686FBCFABBDA4C4EAADE316641363E3B4A2DA67CD445A231BA44C70D28
                                                                                                                                                                                                                      SHA-512:46128BF02E4E757999D4FD3A26C8C47C128EF3E97986F8C69F1862E577D9A46CEFC4C40A505A364AAF4D540D8230F56A00E256443DEDDCAE03FD01D1974DD110
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............N0*....iCCPICC profile..(.}.=H.@.._.E+.v.q.P.,._8J..`...Zu0....4$)...k........... ......"%./).......=...B..T30...e..11.[.._.@....%f..b.....>..Ey...?G..7.....nX...3...y.8.J.B|N<f...........3.F&5O.&...,w0+.*..qDQ5....+..8...k..0..V.\.9.8..@."d.PF....j..H.~..?.....U.#...P!9~.?..Y..p.B1...?F..].Y...c.n...g.Jk...`...z[.......u[.....`.I....4.B.x?.o....@..[k...@..Z......"e.{.;...gZ...JOr.........bKGD..............pHYs.........B(.x....tIME.........?.. .IDATx..w`....3..f........PL3.%.SlJ.D...y.B.BH...f.$...@.[....lI.)../..B.S........+iv.*...V.y..mS.{.o.s...0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\android_electrum_icon_legacy.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):13047
                                                                                                                                                                                                                      Entropy (8bit):7.960630338437363
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:PmQb6xaK2/Npfno80h2yUGnnj393G6zT4o:PBJX/Tf90hvUGnj393VzTl
                                                                                                                                                                                                                      MD5:84B454208A0EFB0F9A3C1DDCB0E12A35
                                                                                                                                                                                                                      SHA1:766685D6287CB52A3679DB3FDE27BE192DBB5FCB
                                                                                                                                                                                                                      SHA-256:38DE29E991C770720C609AE6CF4418CD59C8EC6D20A364738806896C79C99A21
                                                                                                                                                                                                                      SHA-512:E8679AD177DA85310FC759369E00236C2686A030C17094B93B405B66296847FC1DE36A8CA5A50A1E5F9873B44478D4ED5ED1DC789DCE796714C9B61FD1C1B67E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............R.l.....iCCPICC profile..(.}.=H.@.._.E+.v.q.P.,._8J..`...Zu0....4$)...k........... ......"%./).......=...B..T30...e..11.[.._.@....%f..b.....>..Ey...?G..7.....nX...3...y.8.J.B|N<f...........3.F&5O.&...,w0+.*..qDQ5....+..8...k..0..V.\.9.8..@."d.PF....j..H.~..?.....U.#...P!9~.?..Y..p.B1...?F..].Y...c.n...g.Jk...`...z[.......u[.....`.I....4.B.x?.o....@..[k...@..Z......"e.{.;...gZ...JOr.........bKGD..............pHYs.........B(.x....tIME..... ....... .IDATx..w..U.......=...K....R ".U..+....*"W. JGl.U.].^+.U.....!!.$..M..}w.s~.....3.;3.....l.gg.s.....{.E......).`.......,X..`.".....,X..`..E...,.X.`.......,X..`.".....,X..`..E...,.X.`.......,X..`.".....,X..`..E................ 4.CO.4m.@.0...P6.....`......:.X.x....&..F...../.{A..%........-.yv..Na5L\.e.!...K...D.........P..j.._..J..o....`.0.|..O.2..u.Z.'7.....}.......P8..........?..:....*.........d.8.g....7G;...f^.#.gT.._.B.^..;h.b.`.b....2..e...=......^..g.^.S....9..n8.<.x."....

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\bitbox02.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1622
                                                                                                                                                                                                                      Entropy (8bit):7.798153879675446
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:wtv8Yupelq7Hx+iEOQmcYAUp6Dcvtidb9b2:wtEYJq7H1EbfYAxmMU
                                                                                                                                                                                                                      MD5:88C67545CEE57297FB2ECB848EE28A0C
                                                                                                                                                                                                                      SHA1:2B69CD4AF96A93B85B2CDC4589D27AC8DE6FECF1
                                                                                                                                                                                                                      SHA-256:4F03939FCACEBBC2D33C82436E7B204C8C4A84E51B0E7AF1D1731837B13BB827
                                                                                                                                                                                                                      SHA-512:7205B254116DB1493A04E50974B70E1F8017B2C6ACF96280FEA6F92D4041B69B7F2CD1DCECC11BB903E995041A11024805D79285B6B2E85730C9926E827DD831
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...P...P............tEXtSoftware.Adobe ImageReadyq.e<....IDATx...k.G..G......98.*.r.r.......`.-..........s...]..>&H..RH.P..B"..tHA...C`...]!.f.3...$........g.{..1#####.Y.eYq*.*-*5*.CE.\.J.J...`..%1....%'.-.J...E..T...]t....Uu....Uc..d.7.V.V.5|x.V..]i.mM}.TqS.).JV2..p*`...d.x<n...!....t.I)3!...08.)^.....r..<T.).h....- ....N..J.r7...h... ..../..^qr......0......p...@...4...@...4...@...4...@......5......tI?.&...2X.R7..Z..~.Q.Po.W..pu...qS{...*..N.`.9.$.....m7.H.p{,]...D......{...d..o.2J.Lm...mG.....7..0.Zt.t...K..;.... n:N...=~..8.....A...0t.s}}=.#...K-......gF....._....z,..4...h....S".F....C.y<U...........(....O..b..-..u"H...;...*.j.SA.(D.@..L9....S.S.z.}./2..0.1.n.xD.....`..!@.......#V..o.;.,<.{.e/Z...Mv.......O...5.._...yMq..M..X>...EH5.{.d.ruu....9.j.*<...9.....k6?... w.....!....#.D.k!7....w||..,[YYa.D......m....u..o....=.......3...#...y/...J%. 4L.....q.ZZZ...].@..P...._.D[.<.s.<.....8.... ,...p.c..8.....C.{.P...8.r.......{.}..=.x....W.Z

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\bitbox02_unpaired.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1629
                                                                                                                                                                                                                      Entropy (8bit):7.834581298925457
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:3K0Ht2XF2vs/qLLvlhUpMX3FFlXSVB8QVM/kM7DyR+:TLvs/qlhUpMHtXSDukM7L
                                                                                                                                                                                                                      MD5:8259D1CC28BFE5ADB3F3F3EDBDE387A6
                                                                                                                                                                                                                      SHA1:53C5BD011D29674CBF48A88A27AB55E137A31099
                                                                                                                                                                                                                      SHA-256:E7E0D0669C13930D9460F570CAF1627ECC41001F3E09E001CC1BB33DF589D9B5
                                                                                                                                                                                                                      SHA-512:E6C30802EFC171EFA6E16DC968EE94CE3F9EAB06C41E1EA8EDE6014FB6A233D2B4CEE0CC4E4E84F835CB8F1189CF7C457E3E5FE7C3D3745E0EDE487587869836
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...P...P............tEXtSoftware.Adobe ImageReadyq.e<....IDATx..\=L#G..;...&B..@...$..&>.D..H..4.....4.B.\....... ....W.B.d.(bG....B .b..3.2....wfvfY.|.....7.o.]B,,,,,,....F7.9*.*.Tr..1.T....h.....O\..JC. w.Zj.j..,U@[.7.L...T.+..OJ..*....T1.J..8>>nz.V.5....0q..A.....!t.gggdww......299Iz{{/.....988 ...dpp.tuu.\...U*.R...y.2.8sa...@...."D..eG....2.D{....W*..F` ......Uu....s.......9.^.b%...q......X.B.lmm9$......S.0Q..y..H\__.U.....h...Z.-,..@K.%...h...Z.-,....M`..j.m....%...0..............T>I...*pRX....b.8{e......O.x.W....b...3v..p.].Z....y....N..>...J........ .:..U.p....>..&5.....7....4...<777/...h0g.af*.a.7pMXT~v,h....S.*....=55u.iL.LU..c....@.o__.o0a..@.q..........}<....-n.....M.L..}U.C....l...Kl..K...E..1..R&.g.Y...vk.H.X.6>.~(..Vb...O.T....g".&..y...o......_....j.T.W.. ..............Jl.........'.?>%g..%.....C.w?.L.M^.51V..a.8Q_.T.d.......D~..?/.=&.?.Al.(...<I...........D@.4N.Ly...w....h..._;&+...>...9...(.#F..Yp..."....A\._.ibL,..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\bitcoin.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 240 x 240, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):8928
                                                                                                                                                                                                                      Entropy (8bit):7.948051857397655
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:dS8r6wty6g+DOXzBx4nuCy4aYHTgo/lZD4TuxS0gCfpzgUwpR3cNFAYuisr:c82wtGXtKOouuNfhApa8YNsr
                                                                                                                                                                                                                      MD5:E2258D34BC7FBA986F19971C17B47D6E
                                                                                                                                                                                                                      SHA1:109354F506805E780F9CBC349185F060EFC9E8CE
                                                                                                                                                                                                                      SHA-256:E7F66AFD718A21082807DD948CC6E9B06D0CF3BD3181B2A92574E39A3AE4724F
                                                                                                                                                                                                                      SHA-512:3D355087020939EF9DF370FA531DDA4933319E1BC750F899FB47AB2C7C6A2FC64CEA0E8A8DB711BB811069A387455F37D0F7529516B1DD749445DC281372EC7B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............>U.....bKGD..............pHYs.................tIME............. .IDATx..y....?ou...0.(.FE....Yq.WC..Q._.r..11h q$.J".,....!.....Bv.Y.f\.........L..LwW.?.}X.....|...Q......9.wQ..[F..k.6Bq.........b9.:..^....l.H....?.....Q.Ay..pl../e..8......pCT:...4..!.[...d)~.#.-.x3J.L.....`.b.....H......^m..K....g%.q..b..X.cI..`...b....H@..%M.Iz-......M($(.....x....j.S..J.._...+......).Y..pE!.96.d%...d.X.....p.U..P.W.O...=......'_/.G......7.U.S.X..U.9.G]{.`I.E.V...hj.M.v...+:....nY(.X..H...,....X..G.g.^Q...7.QW$.G(...H .P..^.@.....".8B..xE.B....#.`.l/..#.`.."I.#.`.W$.G(...H .P..^.@.4.W$..G..).X..I$....^.@.....".8B..xE.q..,....W.z..]Q.)4>....2...-.,.#.,...O+..*....M...G..{.z.6......A..V.....x.Cu...~..`O.C.......x....T.}m7..6..9Um.Y..J....+.7:T?s3...g.^t.....Wh..&...eE[1.s......x....^.uW..3.....?.b.b...X.x#_.d.....>..9.7.s.V.....M..uc.]...iT.(G....v.|...YM.kS....+....8...L.yS..g..ny....y......ua...|...ua..M..`..@w...h.b.....k.6.Y.".`I.-.8)

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\bookmark.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):455
                                                                                                                                                                                                                      Entropy (8bit):7.042424747937357
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/78/6T/sv7SXmUKQrDUVrDUVrDUUERfexqsLh3:p/6YBUWiiPRmssLh3
                                                                                                                                                                                                                      MD5:AC44F72D2C7A988BD98D8B803C17269E
                                                                                                                                                                                                                      SHA1:5BA8D489497C5B9015154C4812C553424E7A8120
                                                                                                                                                                                                                      SHA-256:DEA30755C1B6F31D91A5A9029EDDD1982B097ACF8A8B1406C8E236A64574A34D
                                                                                                                                                                                                                      SHA-512:D39A3D7585A4B81165E3925B84EE5A2222C8BF9F3ABB1AD618ED09038A1BB297B6C2FC8C031E45A19F9943F605BBD3B443221764D702DB034D526CF3420BDEF1
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...P...P............pHYs................yIDATx...Aj.@.....PH.z.Aob.9P7]........p9%A...6q.....w../..T....NM.K....2@X.......,....;.....X ......&...5.@.....hM,.@kb..Z....X ......&...5.@.....hM,.@kb..Z....X ......&...5.@.....hM,.@kb..Z...p...]7^<....w.n..z=^....|nL....h_.0..Z...&.......W.O..i.w....X`.....$.,.0L...d......E...p. ...7...2k...ps!...F.........>.=....}....Y......P..M]d~.u.p.A..S.r..... "......7...>....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\bookmark.svg

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):588
                                                                                                                                                                                                                      Entropy (8bit):5.488645888225472
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:TMHdoIdSNi/nzVA3/KYf3naXiGEKZx1OpGmDZC98zWHomPQS+2:2dVUNA23Lf3ElEqx1OomDZ/mP7j
                                                                                                                                                                                                                      MD5:9FBFBD6864433EA664DBE4512FF9A9A6
                                                                                                                                                                                                                      SHA1:5920AAB616C75E40038E626B0548C529BC55C947
                                                                                                                                                                                                                      SHA-256:347637DA15F56C9B1B3A925087215F68904DA35768EEA10D8D000A6C53E1D205
                                                                                                                                                                                                                      SHA-512:B4E356201F14B3597F2FEE5205176A63A572449DDD44C258E360BA339B8D3F5A0D3A4502A56FCDAD951AF38C168E8C72238F087B87C53B01D40BCD9852538B86
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="iso-8859-1"?>. Generator: Adobe Illustrator 19.1.1, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 40 40" style="enable-background:new 0 0 40 40;" xml:space="preserve">.<g>..<polygon style="fill:#F78F8F;" points="20,31.441 8.5,37.191 8.5,2.5 31.5,2.5 31.5,37.191 ."/>..<g>...<path style="fill:#C74343;" d="M31,3v33.382l-10.553-5.276L20,30.882l-0.447,0.224L9,36.382V3H31 M32,2H8v36l12-6l12,6V2L32,2z"/>..</g>.</g>.</svg>

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\bookmark_add.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1364
                                                                                                                                                                                                                      Entropy (8bit):7.779704024875446
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:p/6hKcTqJ9+QI3+RXnhvk+6Sjey06Rt6hrXD3zJFxftJ0PaUpkc:p/6hnHR+tntknSj06RtSrzFJJma8
                                                                                                                                                                                                                      MD5:B489310986A6828F9B9D62131D98FC52
                                                                                                                                                                                                                      SHA1:567737353B9C823D2909E44456AFAB161C52D3DF
                                                                                                                                                                                                                      SHA-256:F58B07469ADCBDAFEF16797C66533E90F94F12B94E96E9C2AA1926BD2A1881E8
                                                                                                                                                                                                                      SHA-512:93053CD022CAF74180E0B0CC4F1FEA0C718157AEFE371DB57F376932ED2C547DD93F2E1BF46FAF7452A8BF72A400AEF6DAE9215C15D40A4C919EEC32F6565220
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...P...P............pHYs.................IDATx...O.V.......M.7&M.....h.....N*....a..PS.t......ZUM;.R(......RU...o.i..z.sc'.k.8q.....H..?>|..a...q..[.....N.W....'....s....\.>..|..m..D8@..q.r.TM.........m...N.L/...p,...+..F.I...@;...nP.'.....v.....K.|.9.=.(.T..KA%.Q...Wv%.;.>..@..uA.U.......+0.h.f.....{.......2v..R.WCj.....R......d.N...<.m.,..Kg.m.x.."......i.[.~.f...n...[2\[.+..vGuJ.*9....G...I.[.~.......J.bp.}b9...:...5..Q..ak).._..N;...+........z..l.y..Z.+.h)1.....K..<P.h....nv..&...1.P..B.....5U..]ZP,.>p,O.(..$.JU.....]....qr..U..Y.=f..y........M...L..<u.Pa.I.....?...">m.?}.9.3... .g....D.M%..&....p~.....@.6.cE.g.`..O..1@...J...0....y8S..j.y..k..(l1..E.wI0...p..yk'~...6..x.K|.....P.{..U8.n"=.....D..T.....Rn..9h..r.c.7..h.4.p.D...R..G...%y.....h..b.b.....U...da......4..!E..tC....W..~.H'./_..~...;...PI)...d.S.Z._^....C.A.g..$.J.....<|.s+t...X.$.._..(L.....r.Ty.>..u....Z.cf...)....[S.n.~.l.M#...<.j.Q..j..E.n`.fg

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\bookmark_add.svg

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1082
                                                                                                                                                                                                                      Entropy (8bit):5.469015753372596
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:2dVuAPLPqEfvzPoPDhUP4omDZ/mP7Wo5hyo6pe7vlYU+YsGQ2wUjURxN:cVuAjPmPDW/m1e5hJ62cYsGvwec
                                                                                                                                                                                                                      MD5:F273A1CC480055181AC96A7B5CFAA99A
                                                                                                                                                                                                                      SHA1:71BF75F44063C34873556ABC152C20E9FFB947B1
                                                                                                                                                                                                                      SHA-256:08145AC69FA8B8142FD72954944EEFA873C4F457CE4335898AA66BA6C1E1BF48
                                                                                                                                                                                                                      SHA-512:EAEBA74E36CD877FD299CF81115B9AB56B2CA521CBBEA62D53CED056AEB2E3CAE1BD5CAD9986A3D3D8BF42B58CC5ED6C3B080B6629C9FE8E3E563382B9B43A7B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="iso-8859-1"?>. Generator: Adobe Illustrator 25.2.3, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" baseProfile="basic" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px".. y="0px" viewBox="0 0 40 40" xml:space="preserve">.<g id="Layer_10">.</g>.<g id="fluent_1_">.</g>.<g id="color">.</g>.<g id="office">..<path style="fill:#F78F8F;" d="M20,31.441l-11.5,5.75V2.5h23v34.691L20,31.441z"/>..<path style="fill:#C74343;" d="M31,3v33.382l-10.553-5.276L20,30.882l-0.447,0.224L9,36.382V3H31 M32,2H8v36l12-6l12,6V2L32,2z"/>..<path style="fill:#BAE0BD;" d="M31,26.5c-4.687,0-8.5-3.813-8.5-8.5s3.813-8.5,8.5-8.5s8.5,3.813,8.5,8.5S35.687,26.5,31,26.5z"/>..<path style="fill:#5E9C76;" d="M31,10c4.411,0,8,3.589,8,8s-3.589,8-8,8s-8-3.589-8-8S26.589,10,31,10 M31,9c-4.971,0-9,4.029-9,9...s4.029,9,9,9s9-4.029,9-9S35.971,9,31,9L31,9z"/>..<polygon style="fill:#FFFFFF;" points="32,23 30,23 30,19 26,19 26,17 30,17 30,13 32,

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\bookmark_remove.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1352
                                                                                                                                                                                                                      Entropy (8bit):7.765380971209657
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:p/6qrMGofunXbdmyDEW3qM8S0SmgC+K3FVaDzSjOAhb0Av0:p/6qruGnIwEW3qqCH3faDzSjvpN0
                                                                                                                                                                                                                      MD5:32B1AF7331614E239777D9E89F2A8202
                                                                                                                                                                                                                      SHA1:36F63C393E9540982A4DA4A9764A1662FD9F7BA1
                                                                                                                                                                                                                      SHA-256:2A741F72CCE7FBFA3F4017CC79729EA21E4066F963645D0C669D21AC79251D4A
                                                                                                                                                                                                                      SHA-512:31BB88F613B21CE55C26A72AF2D7D5BDB0A6A723ADEFA2BE9F77B0A0FD54C16FD63EFA7BEF050297CA23D8AE2B2DA85B1EE2126DC67994AC620631E43416E207
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...P...P............pHYs.................IDATx...k[e......^....i..7...7.dMo.5...U:..&.za......X0mt..:.du._.......s./.....v.<.7..m&.<..}...i~<....{...#L.0a.mZW........ .....\..... ".#....M......4... S.D...LM...n..T.V.b..?....0....H....fC.d...9E..S.p6...R\...:......;...-y6,}...-....J..'F.x....G.A5......VJ.q.<<.f....R.....#...)..*.7v..{g'.:r..`a.......i....r|...(..oo.T...`.EW..;.$../xv..~.:..+SM.......a.Y&..?.._v%...I(....v.6.R....7.S.i...n.D.!@.V.N....9j.,./.D>..w.....U3.a.......9E.r..?......Ku.>k;7rb.$q..:.*x`.....OXQx..N...D.lI.......J.....+...r..Ya....<....S.....R.F..H....s..CY.8?..U....."..<.4<.+.}.6.q.p9~.,..WV....m<....)..1.. .z.,......~...W.<..i...........,D.d.()X......>..w..y..Uq....e'..T.VHW......~.t.K.H.])W...h....u...@..L....fBV.....+.kg.."pz...N.C....sd.H.=.6T'..Z.....S..O..r........../..._........<.C..#....|p...x..s...|.C.4......`..X....Xs..kJ.j.il..c..YJR.wgq.>.9....UxN.hA..6..pz..nM......0.hD.ko.0l.y..D....fkej."..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\bookmark_remove.svg

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1032
                                                                                                                                                                                                                      Entropy (8bit):5.50128040726307
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:2dVuAPLPqEfvzPoPDhUP4omDZ/mP7WoihyoY7vlYU+YsjW2xN:cVuAjPmPDW/m1eihJGcYsjR
                                                                                                                                                                                                                      MD5:81CCA7B403F86BB43C974B81CCF04E17
                                                                                                                                                                                                                      SHA1:366177CC215334772D3EC9A4D0874201A168EAA9
                                                                                                                                                                                                                      SHA-256:0ECBC4A4F205C098C33C22FB3C66BB99D93B3E47FE06D03FB191234816B9B267
                                                                                                                                                                                                                      SHA-512:AFB81C0C6639AB502B128AF4528D9F4E80F8C7ABD82E99CEFF6959B79092E8013C8C66B04433FFEBE83745443AA68D8C695B912B80EB02ED05BF64532E877983
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="iso-8859-1"?>. Generator: Adobe Illustrator 25.2.3, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" baseProfile="basic" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px".. y="0px" viewBox="0 0 40 40" xml:space="preserve">.<g id="Layer_10">.</g>.<g id="fluent_1_">.</g>.<g id="color">.</g>.<g id="office">..<path style="fill:#F78F8F;" d="M20,31.441l-11.5,5.75V2.5h23v34.691L20,31.441z"/>..<path style="fill:#C74343;" d="M31,3v33.382l-10.553-5.276L20,30.882l-0.447,0.224L9,36.382V3H31 M32,2H8v36l12-6l12,6V2L32,2z"/>..<path style="fill:#FFC49C;" d="M31,26.5c-4.687,0-8.5-3.813-8.5-8.5s3.813-8.5,8.5-8.5s8.5,3.813,8.5,8.5S35.687,26.5,31,26.5z"/>..<path style="fill:#A16A4A;" d="M31,10c4.411,0,8,3.589,8,8s-3.589,8-8,8s-8-3.589-8-8S26.589,10,31,10 M31,9c-4.971,0-9,4.029-9,9...s4.029,9,9,9s9-4.029,9-9S35.971,9,31,9L31,9z"/>..<rect x="26" y="17" style="fill:#FFFFFF;" width="10" height="2"/>.</g>.<g id="ios">.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\bug.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3075
                                                                                                                                                                                                                      Entropy (8bit):7.904263151460043
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:W/6N1ubZjol2GL5f+aWj8ikmCxKFy+BSefUupxRmNHxie1XV+f4GQq2YMnz+JEfh:WSMZK31jWpDyupxAxxV+Q7nzXfyU
                                                                                                                                                                                                                      MD5:58D5B993E5E1A07C5DAD4000C8190628
                                                                                                                                                                                                                      SHA1:63CF5C244D9FC9AA532512DA0D3011382ABBB372
                                                                                                                                                                                                                      SHA-256:BBE2B982ABF71264A15B456643A73F165C28077F829E0855BE2CB314CB6344AA
                                                                                                                                                                                                                      SHA-512:3D0543B944CA107953B00112CA511780F13045D369A2B698445BB4E6B610502908FD437FC387B79BDA43D3D21B369B20C682CFEBFEB457877F32F3796293ECEB
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............>a.....pHYs.................IDATx..]..]E.>U(V..JQQ...@YT..@ .D.@L..(.H.P..4b.A.......E.(K...E.d.US....Q.RP.........o..gf.{o..KH..o..w.......................3..0Oa^....n....k...\[..#...0/d.c......5(..f.9.s..R..5.s...gQ.)^..f.}...L.=...}.K..s.....U-.aK..T9>u.K\.....#......(.CK..g)s.(..!L...[.F..X].I..j.YGQ5Z..V.).pK'.+vd.F..,..`.d.!.._.jdm..uTM.0.0.2.f..|.s...[...k.7s..,..Xg.k=.4.......e..l..F..7."Z~w'.e.\....<.6.8p............P..K...(..ZC...0...(..N...{).i.G2_.Zx...Z0M...:...&..\8......g.^..3.WPXd.......'..S.....]....B.b..\...7..&.}*0..3.X#.N.ak...f....0a9...OR5...%X. .f...|p..A...W._..G.2......|q..p'@..4...7..;n.....p~.....V[..{...d.&..>.Gf8N ...Vydf.>s?!...cyd...|.T..T...*P.[I..<0.L=.L..^S.k....) $~%.|.`Qg#...6......6....H...v.C.o....Sy.1U......Ic_ .I...7D.7..5L...|..u......j..K...j..........].j.wh..M...K~...3K.hP.z>.z.m..6}~...Y....yq.eZt.X......`F....'....I%..."..]}~...!....Y.N.(.ZI.]..w..h.E_.....4.I..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\camera_dark.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):687
                                                                                                                                                                                                                      Entropy (8bit):7.514196356494635
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/77KTJvSkHqgbo6pj2iA3+pjOLqWfro1MNzPPIey6eEg1HMtYInhhUdEpRrVx4:uZkfooqiAOEZo16yLEg1NW48RZEN
                                                                                                                                                                                                                      MD5:87CE8A3CCB880A6EE050C820EDB75068
                                                                                                                                                                                                                      SHA1:88A3D07B23A5A8CADF3CEE46E78C7EC9A61EF41D
                                                                                                                                                                                                                      SHA-256:341FD5486720DF63EFEAD45A90EC8A9353CEA9ED09EF5508E073F0428D93A708
                                                                                                                                                                                                                      SHA-512:C02FC968499B7C47092C6D59FEA7AA4CC812B8A75CECA831D3FC2358043EF95232592AA35E3DA1E3CDEF3D9DA3B4F2EC1613411C9931C2E9C71BF3EA24B153DB
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...@...@......iq.....bKGD..............pHYs................tIME......+t4.....<IDATx..Z].. ..X.g..5.P._.VE..K..N.'..`0...U8.x.3..3s..p....{.....Y.DD!....8b.^.1.^..v.A.{...........=!...w./.#..H......f......Hx.b4..........pG..{f..W}..R..!....wJ.[...nS@.2s......kK..k.....&.....3FDQ;...R...s...r.\..{.!sK.cJ>.H|z_.H.vl....3.yoY...<.=.V...8...R@.X...6s.M.B_.5..g...M.:... r.*..u.=~_..%G/....o...I..s.<;w.1...;..hJU+....&.[+.Wh..0.".w..".......J.*E.db+.1...b..M..fZ..rg.jEP...O...a.YM......@.........@*|JVc.@..c.>.B..J\/D.....A.Cu..J....>...6..,@K..m-Q...z..C...t.RG...r.I.8.N.P.wxt9<.......A......c$#D.."....j...{.vl.......`0......Qr.,........IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\camera_white.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1304
                                                                                                                                                                                                                      Entropy (8bit):7.73373936021494
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:LKMHZVaoiN+HxWIHcVIFZ5EcOi2xFoJkIB8fQcI70LVHFX1uvXRA2aE8/at33c:LKMrao8IHBrDOrx0lPAJHV1uvBA9E8/r
                                                                                                                                                                                                                      MD5:EB23A09A738F035E563EF333654A4B31
                                                                                                                                                                                                                      SHA1:A8964E27694D3FFF799B752EC18C83558118A08E
                                                                                                                                                                                                                      SHA-256:2454278F24E89C9B8E7602A1422F1E7CE9542A5D6BBFA8550E1F281C0680807F
                                                                                                                                                                                                                      SHA-512:29DD5EC709D7B0479605C59B53F8D16081BDFD754D75FF5A1CDBD67AB7FDB44E02730975F3ED1907E67EFA3E377D853BDA8594140AEFFBC940B3D4DD5DCBB5EA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...@...@......iq.....bKGD.......C......pHYs................tIME.....4 .q".....IDATx..K..U...S..3#..(.$.ua0.A$._..n...KEw....Y.ti@0Y...T.3...F.T4Y..1...83.S...S..~..z........S..s/4h.A...!.Up-.d.fV>...G.........x..O.l.(...1.K.7...73..,*.... ..r<$).E..q]d....l...`...[sKR...gQ..t'.*..p....%|...Uv...2...........I...y.3 .....X{...O..y.Y.I. ......w...o.,r.W..^.~GFI.f.H.I..0W3s..\...9....&."..{~...s.D..&.t..s?..|.|.\.........3.K.....a..XB......tZ..x...&).....yI.......Ss... ......C..JZk..._...)..k..f....1......Jz...n....X.j..N...@..t.f...-.v!rm.lQ..X7.nE.1.^6......Jj...P~w=....=.T....^I...m.Kz.......h..z..N.w..........@X.J..8....#.....1l....<.._....y.X.t_.l... ....`g....~...S....;@.s.^...z.Z..g).K...r.u.Tf.S........../y$....GI.w.B...I"....cA....~..x.~..i..j....N....C.A.8kfi.y.....T@.|..L,....o.`1O.<.~^...j.fv..u...T..Q..u..L+E..].3Sp....p gI...S.........h.MtR.%W....z(@..1..xiO...b..Q`...H.gs..1.+cV.Y......O..i...f..1..y.8M

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\chevron-right.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1044
                                                                                                                                                                                                                      Entropy (8bit):7.628204010871327
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:C/6StB5M1MeKxwTdebhEtSHqyz4hjjhdO8ebivZ3dq:C/6Sb5M2eKxwTdedEgF2QZe1dq
                                                                                                                                                                                                                      MD5:E1FCB8FA7C8B646F58B7081A9242C813
                                                                                                                                                                                                                      SHA1:3DFDD33480CFCCCBB61A35DAD17D2977A8EB2651
                                                                                                                                                                                                                      SHA-256:A714C0CB5D434E4ADCA773815FFF60A37E8204008B698C2CAA805AEAB2E46415
                                                                                                                                                                                                                      SHA-512:9E0F9650EFC1F85CA7A6741B84406D0148024B4BB5FE0553A13A1DD0B88A064563580D6EBC77EDC372963127FE1B40D24BE11C5597FCB68464A98EDEA32BBE80
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...`...`......w8....pHYs.................IDATx..M.VU....Y....`..A..4m.....@lb..."...D.......KG:Hkb..@.0D/g........O..8...(....W...$.^.........{.}.q..(..(..(...A.EP$.[CP1.....o...b.ZH.Q.:.A.J.AFp...!...{..$)..?.n<!D!...l!..z0.A.....Q....7.A.'.p.Ag.B.B.w..Qb...SB./..2..{. ..n<.....~B.1.Cn*.\M.`..z..b.z...z?q+...n.!D.e...~..8B.B...!x.D.1.......Cx....!..Z..w...7q.;..b.|.A..@N..B.B......M..!.Pw>"...G..`5...he...2..........Q........B.~...!N...s(^.,y.3..T......l....=....!..K.A...Zv...~..*k....E.C.....<k.........h....3@8h.....u....C.}.^.mk.e.8^..7i.....A...a.....^.......;...V.........'.[{-=..A}..kk..;3....v}.^..q....Z:.}.^K..b.u...N."lX....|/.......=r.e.^.eXtO.QD..0.......g.L..^K.$....J.......{,...2...E..U.|./.m..'...k5c..;.}/7..h!...|A.6\..t.._./..*...F/.5U...{...~.p.W.Y|...^w....>L^. C.W..Vo&.W.....x.r1...e1.....3.....dc....b6.U....x.2...^.qt.i....}..@..3,.{X......VB.}.^n%...Q.L3.m..]..#>AWX{m...f....}.R.....)C.p%..[.(?...

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\clock1.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 256, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7607
                                                                                                                                                                                                                      Entropy (8bit):7.831394572490859
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:DW4dCKlspppp6L6U0IqcE9ep1cX+qXboPgKJztFyuoaFKcKjfS:aWCKcprge9ep6LXMJptFNfMfDS
                                                                                                                                                                                                                      MD5:EC485EDE1B8D7CC4A86BF8791E4F5D2A
                                                                                                                                                                                                                      SHA1:620EAFD5B00E551A3986952A27906BCB0119697B
                                                                                                                                                                                                                      SHA-256:D24A9CBD7BA52FC55FF1234E137258DC1DFABCB10BD5FE08A0D08E3B617DB346
                                                                                                                                                                                                                      SHA-512:170B63605F75184B5A20405717CC0F8CF8A7E1670EAB3051E2E877B74E7E2B7AA2FFD409812339A85B2DC4DB112A6156DA9D3C150F91F68FAD391CA9A2378F60
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............k.XT....gAMA......a.....PLTE...................................................................................."..$..)..,.. ..!..".. ..$..'..&..(..*..,..1..7..9..=..! .- .!!!%$#%%%)#"/! )))---0" 2$"6&$0..8(&<+(111633666888===C..D..I..M..Q..V..X..]..A.,C0-E1.J0,G20@>=H30J41L63M74O85Q96S;8V=9X>;a..f..h..j..m..p..u..y..~..B@?Z@<]B>AAAEEEIFEIIILIHNNNRNN_C@QQQTPPVVVYVUYYY^ZZ]]]`D@fHDhJFkLHmMIpOKqPLtRNvTOwTPyUP}XTbbbd``fffhdciiiokjmmmtonpppuuuzuuyyy}}}..............................................[V.\W.^Y.`Z.`[.a\.c^.d^.e`.|{.fa.hb.ic.id.lf.nh.nh.pj.qk.rl.tn.vp.wp.xq.zs.zt.|u.}v..x.........................&..6!............................-..>&.O8.RA._K.eQ.sa..y..{..|..|..~..t.....................................................................................`S/....tRNS...................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\clock2.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 256, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):8512
                                                                                                                                                                                                                      Entropy (8bit):7.85639057571749
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:Oswc9zY7L3k9gwwvsQDEfoZeIW8vs7/iIIEKEP+8p:Uc9WLU1wvs9oIBVQEP+8p
                                                                                                                                                                                                                      MD5:D957119A80CF635B49D20CF56F4E1065
                                                                                                                                                                                                                      SHA1:A70F47466330F4B39968723B02FD0170CE92E665
                                                                                                                                                                                                                      SHA-256:FCFCB13DBC166EC8FA671C3D2BDCF365CC8634AA63B94CF69BBB6EEEDE7B0BCD
                                                                                                                                                                                                                      SHA-512:35285A9855E726C69CEFE80CDB03FD4901A66150989DCF0FADBF51D1EFC904C3EFF2DBB4F657096DB8844AF38D0D3E3E3EDC8DFB43A92711BE8E57153388FB94
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............k.XT....gAMA......a.....PLTE..................................................................................................."..%..(..+..-..!..#.. ..%..1..4..7..9..<..! .( .*!.,#.-$.!!!&%%/& ))),,,0& 2("5*$7,%8-&;/(=1)111666888===A..E..H..K..M..Q..V .X!.\"._$.B4,E7.F8/G90H90K<2L<3N>4`$.f&.h'.j(.l).p*.u,.y-.~/..0.Q@6SB8TC8VD9XF;YG<ZH<]J>AAAEEEIIINNN_L@QQQUUUYYY]]]`L@fQDhSFjTGkUHmVIoXJpYKrZLu]Nw_Px_Py`Q}cT~dTbbbfffiiimmmpppuuuxxxzzz}}}.0..2..3..4..5..6..8..9..;..<..=..>..?..@..A..B..D..D..F..G..H..fV.hX.iY.l[.m\.o^.p^.r`.r`.tb.vc.vd.xe.yf.{h.}i..k.I..J..L..M..O..P..P..Z..R..S..T..U..V..X..Y..[..\..\..^.._..`..l..x&..l..n..o..f..p..q..r..s..t..v..v..x..x..y..{..|..|..~..8.X..K..c......................................................................O......tRNS...................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\clock3.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 256, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7229
                                                                                                                                                                                                                      Entropy (8bit):7.785150298696893
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:1aMFUMGlDs8zLR0tOaJHyzDK2VFHzY4MpeXjxH+NXtKSYANS9jSBDanhBUd:1b2MGlDsGLR0tMDj1CsxIthk/ed
                                                                                                                                                                                                                      MD5:D98936082F2FE74CEC8ADC729DAE1FB6
                                                                                                                                                                                                                      SHA1:82B03877AE7E92E88B94359CF02AE6F9D3058C83
                                                                                                                                                                                                                      SHA-256:8E8EAD8B910B4528A6AC8C4CD8D7604432D7CE51FD166B79FB4A19816866180A
                                                                                                                                                                                                                      SHA-512:7936AAEEAA21AC5FCDD4C59A23768582B7A272259632921B14FD389A5C68447E11EAEFF009F2D410296B860870D5DC430CA96B4CCB0AE321F3711E55852E7FA6
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............k.XT....gAMA......a.....PLTE......................................................................................................... .."..%.. .. ..' .)!.,$." .%".'$.(%.*'.+(.,)./,.0'.2).4+.6,.8..<1.!!!&&%)(&)))--,0- 41"11.95%=9(111773665;:7999>=:===B6.E9.H;.I<.L?.A=+M@.PB.RD.VG.\K.D@-AA=JE1MH3NI4PK5QL6TO8VP9XR:ZT<\V=_Y?`O.aP.fT.hV.jX.lY.o\.q].t`.xc.yd.~h.AAAFEAEEEIIGIIIMLINNNTSNQQQUUUZZUYYY^^^a[@g`DibFleHohJdb\piJrkLunNwpO~vSbbbffcfffhhenleiiimmmpngpppttquuuzytyyy}}}.j..l..n..p..t..w..y..{..|..~..yV.}X............................................[..\..^..`..b..e..f..h..i..j..m..p..q..r..t..t..u..w..x..z..z..|..|..}.......................................................................................................................................Z\.....tRNS...................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\clock4.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 256, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7522
                                                                                                                                                                                                                      Entropy (8bit):7.81127387729523
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:jsw06+k8CmaUTBvA+j8eOf6PxPMkguT6EKp:C/FRFj8uPMk7T6d
                                                                                                                                                                                                                      MD5:F4FA836357AEF23E14DA4AC2298BA63F
                                                                                                                                                                                                                      SHA1:1EFBCBEBB328200BFFB856090BFE67C8FE5DA504
                                                                                                                                                                                                                      SHA-256:3819F45A09E2016EA873216BCB9BCFF4BF581FCF6740B7E2ECF0CD0723BFA628
                                                                                                                                                                                                                      SHA-512:4EC5EE28988B2A66DE20A6CDF805408C92BCB06421A1AAD91F972B0B3FC6CA582604C97985C463CE29D5DAA7F6D34B9BEDE4FB44FA11C2F9A8B6D800F644EF0C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............k.XT....gAMA......a.....PLTE.................................................................................................... .."..$.. . %."(.$*.&,.(/. "."$.$&.&(.)-.(*.*-.,/.)0.,3.-5.19.4<.!!!&&&))),,,.1 03"14"47$58%8;'9<(111666888===7@.9B.:D.<F.>H.;B.=A+@J.BM.DO.EQ.JV.LX.Q^.@D-DH0HL2JN4LP5PT8RX4SX:TY;UZ<W\=Z_?S`.Xf.Zi.\k.]l.`o.aq.dt.hy.k|.m~.AAAEEEIIINNNQQQUUUYYY]]]\a@bgDchEflHhnIjpJouNpvNrxPtzQv|Rx~Tbbbfffiiimmmpppuuuyyy}}}n..q..r..t..v..x..z..~..z.V|.W~.X..................................................Z..[..\..\..^.._..`..b..c..d..f..i..j..l..n..p..r..s..t..u..v..x..y..z..{..|..}..~............................................................................................#..F..^............................................................................u'E1....tRNS...................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\clock5.pdn

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Paint.NET image data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):40479
                                                                                                                                                                                                                      Entropy (8bit):7.479786333974441
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:pPjUB/mEJUGImzqgyKHjVvrJYG04NBmZaIgnFk2SHM3cAwA54KH3333DOd:+XpFzqgDVvrPXmzN/IcDwE
                                                                                                                                                                                                                      MD5:936FBAC7C0125C83CE95F6771890DCED
                                                                                                                                                                                                                      SHA1:2FB70236A591EBA04C4A13CCF18886BD3BD94468
                                                                                                                                                                                                                      SHA-256:E7D7FBFFCA2E88099B3F92093137742F382D902FF5382940193CC0C8FF0A8729
                                                                                                                                                                                                                      SHA-512:43D1C95397B230601A8166964232025ACCD2935F24607EA1E92F447A68C1DB39F622E567D72F633154A9ECC5487E0DCFB0AD88429A399312958722D65C2C8566
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:PDN3.:.<pdnImage width="256" height="256" layers="8" savedWithVersion="4.100.6822.38824"><custom><thumb png="iVBORw0KGgoAAAANSUhEUgAAAQAAAAEACAYAAABccqhmAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAACshSURBVHhe7Z0J3E1V98c3HvM8kyHzFJEUld4KlYSQf2VooEmaEA1UvIZIiMxD4UmhwVBSSmVqIDJPSRJvRKI019v6r9899/He5551p+e5wzn3rt/n8/3Up845z9377L3P3muvtbZRqVQqlUqlUqlUKpVKpVKpVCqVSqVSqVQqlUqlUqlUKpVKpVKpVCqVSqVSqVQqlUqlUqlUKpVKpVKpVCqVSqVSqVQqlUqlUqlUKpVKpVJFoJxMHqYAU4Qpy9RnWjFdmX7MSOY5ZjrzArOAWcIs9v7788w0ZgIzgunD4N6WTD2mNINn52dyM/ibKpUqAcrF1GG6MMOYdGYls5M5wfzDUJT5L3OM2cq8w8xhhjI3MtWZHIxKpYqy8jHNmPuYmcx65mdG6qSJ5CSzhpnE3MWcz+RlVCpVBML0vQ0zhPmQ+ZWJxRc91uA3/8K8zwxksBwpzqhUKh/hC4+v5f0MvqDo8JhuS53KzfzNYObyNnM7cy6jMwRVSqow05QZxRxifmOkTpOsYHaAge4gM5xpzMC4qFIlrdDA0dDHMV8xsev0OQzlyZtGhYvkp1Kli1CFSiWpWo1yVLtuBapzTkWq16AyNWhUhRo2rkrnNDZUt5GhWvUN1TzHULU6hipXN1SuoqESpQ0VKoJnCX8jumAw2Ms8yWDHATsaKpXrBcs4ts96MpsYNHSpA0RMzlw5PR28bPliVKvOWdSmfRPq83B7mjq7N61YO5Q+2foMfb53PO38ejLtPzqDDp+aQ0d/Tqfjv82j739

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\clock5.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 256, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):10074
                                                                                                                                                                                                                      Entropy (8bit):7.879043925395544
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:y7rsWYYYYWyAdow9w527mWGZiFXqlmIRJRFJwOZHTrra2pow7E5+20CSwAO49nYh:udYYYYhAdXw527fGZY6FRl1+GX7UJ0Pk
                                                                                                                                                                                                                      MD5:A4B58F558D7EC991FA56D9198695295C
                                                                                                                                                                                                                      SHA1:2A27A86928564014E22038FF5286FD5D3C7803C2
                                                                                                                                                                                                                      SHA-256:E59B42DABAB1D50CCB440460BF4847C28DE23249F5B6901FD7DA26A4CF51EAA4
                                                                                                                                                                                                                      SHA-512:4473CFD4E32C840523DA30E5CDB466E85A5E703BEEB29A2B1BF406173A5ED5220E4D2CA3D5F24678BD79B2DEE37CCDF9FDFA671C0D34A798617D4963E0E3CEA0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............k.XT....gAMA......a.....PLTE......................................................................................................................"..%..#..'..&..!..%..)..)..,..)..(..!..#..$..0..1..5..8..2..:..9..<. (.!*.#,.$-.!!!&&&(((***,,,&0 (2!)4",7$-9&111666888===.B..C..E..I..L.!K. M."L.!Q.#P.#U.$W.$Y.&].3@*6D-9H0=L2>N4'`.(a.*f.+h.,j.,m..q.0u.1y.3|.4~.7z.@P5CT8DU8FX:I[<I\=L_?@@@BBBEEEIIIMMMNNNPPPRRRUUUVVVYYY\\\^^^NbAPdBTiFXnIZpJ^vNayPe~T```bbbdddfffiiilllnnnpppuuuxxxzzz|||~~~5..6..8..8..:..;..<..=..?..@..A..B..D..F..G..H..I..J..L..L..N..]..i.Wk.Yl.Zn.[n.\q.^w.cx.d{.f|.g..iO..P..Q..S..T..V..X..Y..[..\..]..^..`..`..b..c..d..e..g..h..i..t..~.#..l..n..p..q..r..t..t..u..z..z..{..|..}..~..5..F..]..q...................................................................;....tRNS...................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\closebutton.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 60 x 43, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3521
                                                                                                                                                                                                                      Entropy (8bit):7.9323910528379065
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:S6MC1mfxQGFRS5VXbT/yeTaDLrDhSU8vK5:SaomgRSfbTdefrdZS6
                                                                                                                                                                                                                      MD5:07EEB16ED0040531D2568CF359468D91
                                                                                                                                                                                                                      SHA1:69BA21DE53159D068389A698D9BEEAEE8FA87D2F
                                                                                                                                                                                                                      SHA-256:0E6FC1B67FCFEA30ADE09EFEC461E9CE1A3A2EF99683FB83BC3B2D2A9442B50B
                                                                                                                                                                                                                      SHA-512:1975BF10DAAFAAB18430359C0C301AAB274A4E7D20605A7BA6FAA83AC2B2185E336EB78B421A6DA9700D19661072028EC1973CB6E7685C4A04D881FF609125B7
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...<...+.....$/.Q...AiCCPICC Profile..H...wTS....7..." %..z. .;H..Q.I.P...&vD.F..)VdT..G."cE....b....P..QDE..k..5....Y.....g.}..P....tX..4.X....\..........X...ff.G.D....=...H.....d..,.P&s...."7C$...E.6<~&....S...2.....)2.12....."..l...+...&..Y...4...P.%...\.%.g.|.e.TI....(....L.0.._..&.l.2E.........9.r...9h..x.g...Ib...i...f..S.b1+..M.xL.....0...o.E.%Ym.h.....Y..h.....~S.=.z.U.&..A..Y.l./....$Z.....U..m.@..O. .........l^....'....ls..k.+.7...o..9.....V;..?.#I.3eE..KD......d......9i...,......UQ....h..<.X..d.......6'..~.k.hu_.}.9P.I..o=.C#.$n?z.}.[.1...h...s.2z.....\.n.LA"S....dr%.,...l.....t..4..0.,`...3p.. ...H.....H.i@..A>...A1..v.jp..z..N.6p.\.W..p...G@...K0..i......A......B...Z.yCAP8...C....@..&..*...CP=.#t...]..... 4...}.....a......;..G...Dx.......J..>........,._..@....FX...DB.X$..!k."...E.......H.q.....a......Y..bVa.bJ0.c.VL..6f.3....b..X'.?v.6...-.V`.`[.....a.;.......p~..\2n5...........&.x.*.....s.b|!.........'..Z.k..!. $l$T

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\cloud_no.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 344 x 344, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):14573
                                                                                                                                                                                                                      Entropy (8bit):7.920266929168651
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:UiH7JdrGAPcFuLFpNQ/PfN7Tr/SLNdfc9GOVXyTO:PHddr1JFpNkHJTrq5ux8TO
                                                                                                                                                                                                                      MD5:91A7EC74C96AB0C177AD6775BDF07E93
                                                                                                                                                                                                                      SHA1:72E6C153AA571AA7DEABDB2CD52E46C98CEAFFAE
                                                                                                                                                                                                                      SHA-256:9FBFCF114A0AE26F486AA31D1647F21F291760C322A3805037D48FC6B904A388
                                                                                                                                                                                                                      SHA-512:D367A3AE76ADC3304643F687930325D15EC40905405219270CD14E516476F1FE612549055354F3E4587B3A19C51F8B108AB11D8940F493B8A74665128B11FC4B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...X...X......l.@....bKGD............ .IDATx..y.\U....Vw'......HB6....2.#.2/...a.@......Pv.@6!..1..:...2. 8. `......tw.......v-w9.{o.{.>..G?.....r.N..U.0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0..0... .....?<...?...3.O.y...Q.a........{. ..@..M..E.?MZ..-Q.a.....v..CN.9z..5ew.5......7E21.a..D*X....d..I,..VA.&,Y.a.I$.. W..,.0......K.a.DQQ.....K.a..P1.. W..,.0.."..P.&,Y.ab..v..3.9. Z..\.`n&C.?.....d....PW..\......d...-..`.m.....s3.......{0..h........d...w....Y..c.........`k2..P1....?.=..J.a.8.....u.R.)K.a.X..`.3.O..?.Q...,.0.!.....<h.0.<....z..W.0..9.^..e.&..I..,.0i."..e.2..F*.e/,Y.a.FE...%.0L....n.d..I...d.K.a.4....d...v"..n.,.0.L...X...T/...`.2.S..B..K..9x%5..o..S.....AP3...9j....:A.....lN..... ...r9.>....6!..Bv.P.9W.-{Oi...c.p..O.q"6..X.I$/.]..24O..'.....`&..A. ..b;..fAx...%rx..x..[..V.~..`...J..K6.....s....a.>..C.0..L.........!.K..7........!..;..,..e.MCc.@.. ...8......@...f....Ea..o...N.Y.4.(.K..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\cloud_yes.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 344 x 344, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):8329
                                                                                                                                                                                                                      Entropy (8bit):7.763067899763679
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:HS9co0ZDo46eSNj0IzZMF5InvbJeZhZpCc2gBUBPb+YbUFsb8:yuozeSNQ0ZMAjJeZhTCHgeYYbY
                                                                                                                                                                                                                      MD5:8477160CC0DE301D338DF75CA1F09CE7
                                                                                                                                                                                                                      SHA1:F8DB6074FF1A4B8FDFE687DA6579E1570C4CB6D2
                                                                                                                                                                                                                      SHA-256:E6E57571718E100EC906099C2FDEE135A25A5B7D4AD7B263D848C26C55E6D456
                                                                                                                                                                                                                      SHA-512:EBF44772AD1D8EDDC3699339E97FA32DE998B0FBBEAE6CC81EF93521BCFD8EC8FB76B9D61FB29BFB304B02B3C98CBB4BAF96CDC626F4CD7652DF9426B15C67E1
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...X...X......l.@....pHYs............... .IDATx..o..y._...^.)..I...*u......E.8m.]l.4q....h.m.8.$...[$E."e......m.I.x.m..&u.4.l..i..CR.x.o...Y.C..I.......x..................................................................................................................................................V..]....`QaS....g.......c....Bg.eks..Y..o.6..,t.......i....)...4..U..h-l.7.6.j.......V...t^..#V.v>Y.^..$..N.V....B.ls...\.V.3.9..:..Na.|.x..4.F...&...1......._.7.?aqz......`i2m.....z.6.@.._..;6W(ls.'f9R..X.0y..P^.........39.o6....P~.....|...UZ...Y].[....y..._p..}.y....k.}-.).5..?7..)E...\..VW....*.X.....Bcq.F-.....s{.n.....V...^ou.x...9.....B.S.y...w.......=hi.>...,...:[.ONH...]\.+...r.T.S.{p~nq..._?..?3....3PX..:\...Z.T.-.jb.....x..:|?.8.......g.`r.k..l-7.....AQ.R..Xg.u.........................%.gf.><...X.6...[9..g...?..:...6.>X.....%xKV.._.r.uB....NLN..'..-.m....w..Q..y...Pk.+xO......c..r..rD..8VW...w.....r..X.....;.......'...l..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\coldcard.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5283
                                                                                                                                                                                                                      Entropy (8bit):7.742906001757597
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:jknmWIC4/VHmbJX/D6AWaSaBv3LItxj3gBgvEm5DmFR:jkn6YJmAMaBv38zj1vEXR
                                                                                                                                                                                                                      MD5:B999C41086083E5F35D8464CB88384FF
                                                                                                                                                                                                                      SHA1:3F0CBE3D67A92081CB81DCDA546898743B5A48C9
                                                                                                                                                                                                                      SHA-256:E2935A7BBFA30974E65D79394BD3D01EECD741951EB3185A1F4CE9BABE62716C
                                                                                                                                                                                                                      SHA-512:4AC7B5CF61ADC065521E9D0F9CD0BA34B6D8B231433B79D83963262679E3C81E922A81831CEB9D9930E9A73487E9EA34EB8A681AA93A29A47D2A6CE58A98F1B0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...P...P............pHYs...#...#.x.?v....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164460, 2020/05/12-16:04:17 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 21.2 (Macintosh)" xmp:CreateDate="2022-03-11T10:05:35-05:00" xmp:ModifyDate="2022-03-11T10:12:17-05:00" xmp:MetadataDate="2022-03-11T10:12:17-05:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:9179abb6-f3c0-4893-b300-e3eec0c120c6" xmpMM:DocumentID="xmp.did:9179abb6-f3c0-4893-b300-e3eec0c120c6" xmpMM:Origin

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\coldcard.svg

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2652
                                                                                                                                                                                                                      Entropy (8bit):4.974927453525817
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:020lSdlkdlEYvYdWQYoNEXWhjuX7qgN/4QSwhj8hzhZo7tJZJN:isdlkdl6WSjJ0qgNr3N
                                                                                                                                                                                                                      MD5:4CD7B06B074D75A052B128B1EAE6AE35
                                                                                                                                                                                                                      SHA1:B817362DCA6C89ECD8C9601C90B95CB8740633B2
                                                                                                                                                                                                                      SHA-256:7473EB6E4C90EDC6B9D3FA5D15C6D7B4CE65268C5C7838E5BA6E16A1CE981171
                                                                                                                                                                                                                      SHA-512:CD3A3E01FA538ACE4EE3647FB37AFEE63D4F3DFBE91C67B0CDADE55E8DC47FBB731F6345662406736825E32295D95BE784268FFF07A7EEF1A4A953A55FA2D13C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 80 80"><defs><style>.cls-1,.cls-2{fill:#fff;}.cls-2,.cls-3{fill-rule:evenodd;}.cls-4{fill:#ff0032;}.cls-5{fill:#00d30d;}</style></defs><path d="M16.66,78.7a4.28,4.28,0,0,1-4.28-4.28V5.64a4.28,4.28,0,0,1,4.28-4.28H54a4.29,4.29,0,0,1,4.29,4.28V74.42A4.29,4.29,0,0,1,54,78.7Z"/><path class="cls-1" d="M54,1.36a4.29,4.29,0,0,1,4.29,4.28V74.42A4.29,4.29,0,0,1,54,78.7H16.66a4.28,4.28,0,0,1-4.28-4.28V5.64a4.28,4.28,0,0,1,4.28-4.28H54m0-.89H16.66a5.18,5.18,0,0,0-5.17,5.17V74.42a5.18,5.18,0,0,0,5.17,5.18H54a5.18,5.18,0,0,0,5.18-5.18V5.64A5.18,5.18,0,0,0,54,.47Z"/><path class="cls-1" d="M54,0H16.66a5.62,5.62,0,0,0-5.61,5.61V74.39A5.61,5.61,0,0,0,16.66,80H54a5.61,5.61,0,0,0,5.61-5.61V5.64A5.63,5.63,0,0,0,54,0ZM16.66,2.72H54v0a2.93,2.93,0,0,1,2.93,2.92V74.39A2.93,2.93,0,0,1,54,77.31H16.66a2.92,2.92,0,0,1-2.92-2.92V5.64A2.92,2.92,0,0,1,16.66,2.72Z"/><rect class="cls-1" x="16.89" y="7.91" width="36.84" height="66.51"

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\coldcard_unpaired.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5242
                                                                                                                                                                                                                      Entropy (8bit):7.753235998143419
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:jknmWICZ/ODmFEHmGGdyw0uvnSX2PNdbKYLSoDOBmhDZJ0KobbT:jknuZ2yqaX6Gg20Dj0NbbT
                                                                                                                                                                                                                      MD5:6A45E384D7D681397143F4F3FC978EB0
                                                                                                                                                                                                                      SHA1:AE66424F180643900EA63948A6CC554D24D877AF
                                                                                                                                                                                                                      SHA-256:2BC126C7DBBE256D45E5890DCE1FE9F2C98E2F29520DE8296ED06299497BA408
                                                                                                                                                                                                                      SHA-512:211D7A8E354B9A1A75CFE01BC795B838E6F019FB5702AEE00DF280DC4669F0341309BD4C031D06303EC29A641F2BDFD36C4881EC489ED88FCE8F53AAB74D40EE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...P...P............pHYs...#...#.x.?v....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164460, 2020/05/12-16:04:17 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 21.2 (Macintosh)" xmp:CreateDate="2022-03-11T10:05:54-05:00" xmp:ModifyDate="2022-03-11T10:12:28-05:00" xmp:MetadataDate="2022-03-11T10:12:28-05:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:f317a6c8-5482-4a1c-8b72-7d8f79a2414a" xmpMM:DocumentID="xmp.did:f317a6c8-5482-4a1c-8b72-7d8f79a2414a" xmpMM:Origin

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\coldcard_unpaired.svg

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3566
                                                                                                                                                                                                                      Entropy (8bit):5.208716809158055
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:cDAvf3HJK5Cx15vbZQ/xp8T5XtmE3XXjLlkoqhL0QjpBeuY8d+3uJfR2:nvfd3ZQ/xSOayoqhoQf9td+3GfR2
                                                                                                                                                                                                                      MD5:3D1871F9FD1BF9D1F5994F76F0DDA54C
                                                                                                                                                                                                                      SHA1:1944054008D8C6F9F17C17E72EA41383F403904B
                                                                                                                                                                                                                      SHA-256:6C189E6791B02AE1029D274024EAA087126D97989B2BAC3FF095A121A715B55B
                                                                                                                                                                                                                      SHA-512:8DCF4B94C25E6AA3DA1C9CADD8860D26B4F3B2F6D3DA68D0352D91278C05B6F4F87D7EDEA8C7CF2FA9D87AC8387F6F33C2DFA8D94F2051A483739036B10EEE7E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="utf-8"?>. Generator: Adobe Illustrator 24.3.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 80 80" enable-background="new 0 0 80 80" xml:space="preserve">.<g>..<g>...<g>....<path d="M16.66,78.7c-2.36,0-4.28-1.92-4.28-4.28V5.64c0-2.36,1.92-4.28,4.28-4.28h37.3c2.36,0,4.28,1.92,4.28,4.28v68.78.....c0,2.36-1.92,4.28-4.28,4.28H16.66z"/>....<path fill="#FFFFFF" d="M53.96,1.36c2.36,0,4.28,1.92,4.28,4.28v68.78c0,2.36-1.92,4.28-4.28,4.28h-37.3.....c-2.36,0-4.28-1.92-4.28-4.28V5.64c0-2.36,1.92-4.28,4.28-4.28H53.96 M53.96,0.47h-37.3c-2.85,0-5.17,2.32-5.17,5.17v68.78.....c0,2.85,2.32,5.17,5.17,5.17h37.3c2.85,0,5.17-2.32,5.17-5.17V5.64C59.14,2.79,56.82,0.47,53.96,0.47L53.96,0.47z"/>...</g>...<path fill="#FFFFFF" d="M53.96,0h-37.3c-3.09,0-5.61,2.52-5.61,5.61v68.78c0,3.09,2.52,5.61,5.61,5.61h37.3....c3.09,0,5.61-2.51,5.6

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\confirmed.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):54212
                                                                                                                                                                                                                      Entropy (8bit):7.970233760777671
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:rGahqm2/VbUguDy6As9ShagaUydNCgTNPJAva3gc:rjMf/VmDnAsUkgaFZhv3l
                                                                                                                                                                                                                      MD5:8C98780B65103F87BA4F098B7899C4D8
                                                                                                                                                                                                                      SHA1:3F4D4499D9AD2EF94FB50BAA5EF44E83D6C74A85
                                                                                                                                                                                                                      SHA-256:B360C75FF523EB1EFFBD4E9604985551F164E3EFEC13F36B8C766684469880F1
                                                                                                                                                                                                                      SHA-512:A0DFC1C1B24C6E5D48BA90CE0EB61531C354CAB31401994B888890855E5EF85A5EDE818465625D1186EF685BA752BDCD66438FC32288E6EA063E5C24055E6CE0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............}......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.........B(.x....IDATx..w......6g.U.9!. .$r..&.0...9.|...;..>.G..c... r..Q.a...(..6i..t..L....vVR...lw....y...hiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii.._`<~.y.n..#........E...a9L...qE..s$+...hiiii...a.....#./a>..aY..v$J.XKKKK...W.<....%..c>.0./a.h..y$I.......v......."...<.?.0.M=..-`---..U......s.]'.G'N..x...=.M?..v......D.!..^.....9..Q.m.>..]..ZZZZG..P..q.g.Y.n......P.g.>`---..I..~..@.........g..p.g.>`---..E..pD...IY(-..2...X.U.>..Q..ZZZZG.~..0...aY,U...@..ZZZZG.n..x.@M.J.s........:.U./.b1..............u......'....6.X....|.~o.vAkiii.i./.Q..7.yCk0bX..x....S..-`---.#I.....+

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\confirmed.svg

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4153
                                                                                                                                                                                                                      Entropy (8bit):5.390703146235449
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:cyKzFK4NPG/egTjF6EweHvNeHfNwguH3nlZeZo8LLnLwGCHcGwmsHGs2Ani3klwp:1Kg9zvk03rE4KtBTwsmd5mclm6
                                                                                                                                                                                                                      MD5:A45C349F80FCF0B030D1583D03A78C67
                                                                                                                                                                                                                      SHA1:45C4AABF47F6E8F21E43A7F3AAFF7F6DFE9276BC
                                                                                                                                                                                                                      SHA-256:761C0AC1595E2D15E0261B8D2201FEF930F45BCF5C98340F54D025DB67E1E408
                                                                                                                                                                                                                      SHA-512:8F8CAA1A6B7D75F30170D86698C2F26E02A3C1D90217130FCF39494952409B3FBEE0868C4A082B08680F203F86B74D5EBE6D64355AD9BABF1F5AD76A9C53686E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">. https://commons.wikimedia.org/wiki/File:CrystalClearActionApply.svg -->.<svg width="512" height="512" viewBox="0 0 128 128" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">.<defs>. <linearGradient id="linearGradient3930">. <stop style="stop-color:#ffffff;stop-opacity:1" offset="0"/>. <stop style="stop-color:#b3d187;stop-opacity:1" offset="0.53316939"/>. <stop style="stop-color:#28f400;stop-opacity:1" offset="1"/>. </linearGradient>. <linearGradient. id="linearGradient3904">. <stop style="stop-color:#4df60b;stop-opacity:1" offset="0"/>. <stop style="stop-color:#008000;stop-opacity:1" offset="1"/>. </linearGradient>. <linearGradient. id="linearGradient3878">. <stop style="stop-color:#79ef39;stop-opacity:1" offset="0"/>. <stop style="stop-col

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\confirmed_bw.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5113
                                                                                                                                                                                                                      Entropy (8bit):7.936619810260154
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:WxZ9SAxubw9s9UKLQfcA5w9IUwVv7EmJSrnj7ZvmCrlm16j:WxZcA4U9l497wxAmJafZnlm+
                                                                                                                                                                                                                      MD5:E168A886B7A1ACB98874E398016424C0
                                                                                                                                                                                                                      SHA1:85247B8FC71D4B079567CABB36ED539421FE2251
                                                                                                                                                                                                                      SHA-256:DF9C20D1B59FDD66EC7C7D914AB2DCF05C5D7A135FBA1EE5DFB33F723049E08F
                                                                                                                                                                                                                      SHA-512:BC5A8D661C4083978CF140CDB9523FA64B289D4F720EC3C85CA936CA30DE4F37BE83EC51C407A759C0086C5D054EBF01AA5C403C36AA05E83861F371B70835F8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...@...@......iq.....bKGD.......C......pHYs...F...F.2.v.....tIME.......Ni./....IDATx..[}t...=..w.dH...@T"PeE>"V...k.VD.I..Scw...V..Z{...g....n[qUj...*-..Z.Q).&b..QA...!.c&.....>..LB.......y.{.....>.......F%JJB....$..|...:...Q......p...3.:......i.....F?..=///.........V.H...].&..\..?..7....[,.....(.D@...).83`.0........6...h......%7Y[{I..h......%KB...'|q...J...."#.8..N...}?.,.<.w..-..s.....:[.......q\.D....PQ.....V.E..".+4. ..X.....d...d.....I....1..r.H`/0.DH.V...s.M=&......... ..q......XG..g.Qp...g..Lh.M.X.$b,.}..:'G.3qww7)........U)1..V.C.v..{.D.l9eIm.$...X......j3..<.t.[..h........G.4'. i.]..u.....6.F...=6...........p{.#.P.Z.&.J.s. SND9`.=.Aq.....(.YWUU..........a....Ab3..N.0....P...C/..&....G..?S.b1.%........E..@.f..4.}.d..]xa...._..@..lYA...X.P.-..p...$v.+..............*.N_.Tt....".ef....I....>Z[=mwV..7..}....:u..k...=.......B.g&1.....`...X.........:e.....@R.f...^6..Y=}z.@8........_.._....mlA;.U?J.%.....`.....|b.P...!h."{6....%}r.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\copy.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2111
                                                                                                                                                                                                                      Entropy (8bit):7.875754382663259
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:mglnOTo/lbssCAgsysVdlptoKTl2h5fip6pQzz/xyNRcGt7k:mYeo/lHDZd1to4sXfu6ssHcGtg
                                                                                                                                                                                                                      MD5:70670904C4B157557987B0F7A24D94A0
                                                                                                                                                                                                                      SHA1:2F7E04659C6BB6DA6657E56CD1F1BAF1B5883C7C
                                                                                                                                                                                                                      SHA-256:30155ADE9AD1D64EA9D677BDAE9BEE9E46DF6B945EC27E07B988C0E57D1B243B
                                                                                                                                                                                                                      SHA-512:EF6ED5F39D6E9741A1EFA8FA9C4AD7CFC26ED3DE056DC44C1E3EFFF4E7272F4DE5284F69F7E6E6D4900CD830BE4771A488EF7554C72490080B8602C8DB7EA5E4
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...0...0.....W.......IDATh..Z.]U...u.....i...JbL..P.1......A.~F....b....o..bL .../cPH..} 1&R?.@..M;.t.2.0.....p.9..sn.NGt%..u.^{.>..{.PCw=~:.O.6s..d...x......Np$.C..>r..~..g.......s.[Y...L.0....:&Z..;o.......>...k'9.VWj%n.....$Y>K.....k.5s..5.2.b.....mW.,..'.^..........@....79..b.....X8.....Q.)B..U^..x.Y...^=...<.p...GO....=...nD.B...*.IfT..q]R{w....&...X...L0...0...&.Q.z.%nv.L.=...)..K..J@.....=...x.2...7..s1..x)...v3]f.$4....7...Y&tB..&.[.LB...4.1...u..R..l.U............._...g3L.9..=....P.I@.(.d..*^.W.......U.o..yg.....}x...d..s-X.H.%..L.I0Y..#.)....>.....O.....qU..k.....P."...@bi.W..p..7....C..T...8..Z.r....as.R.....,.. e.. .W...]..c.{...S......s.#...U....F.B...RB..jIC.S'..;....1...fu.....c#V9IP.....*b.&."...O..<t..\..=r(...O..C...m....U....T...^..U.RU.g.I.......V.:...y._.v+..v..o...Rj..P.?n}2....k.15.x..kkkm. ......6.....8#.....%..n|....<{.;&..I,.I.M..+.6.n..V|..mXX.8=.......#......o.........o..e....U....

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\copy_bw.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 230 x 211, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):880
                                                                                                                                                                                                                      Entropy (8bit):6.766956341538328
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:ZDs/6kUuzmGBBw8AkRcciRwcciR34ggSok6iRtrciRMc:+/6kUkm5NksRfRIggbkBRBRMc
                                                                                                                                                                                                                      MD5:5838D4A177598A54BA3301FC078EA437
                                                                                                                                                                                                                      SHA1:F2173607FF1C220FEDD1014C56BF46381D6B583C
                                                                                                                                                                                                                      SHA-256:4BFEDC4BE17B53F40B0FB48A1B51D5BDFB0DD83EC65D02792DA2DD95BE11334D
                                                                                                                                                                                                                      SHA-512:7CA85EA848198AF3E66950F65B7905AFDCB91FE83725AD315D6E33D4E76A74A495B547D97A9D021F4AE696CEF9E4A06D6EAC3F1E31353C999D8F2364A35B7E63
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...............o.....bKGD..............pHYs.................tIME........t......IDATx...12%A....l.Dd32DJ....r........d.....fB...#....7..J....._U.7]3....-......&...&...&...& L.& L.& L.&....y....w.<.?.0.0.........KY.& L@. L@. L@. L@..0A.@.).b.....;.j;O...._.....Kr.UuZ..w7Z.0.a...a..z.....J...C7.0.%......., L.& L.&.d...o;....$......Jranw.a.0-e.=& L.& L.& L.& L@. L@.0Wv..s~I.hJV..d..fwI;....HKU..l...s.R..c...a...a...a................................&...&...&...& L.& L.& L.& L@. L@. L@. L@..0A..0A..0A..0.a.0.a.0.a.0.a...a...a...a................................&...&...h1.g...$.id...V>..tlf.....Xx...O..?.s\.P.L'........&...&...&...& L.& L..).b.I....=}.;.K.aw.7\.|2.].ZX.{L@. L@..0A..0A..0A..0..,.Au.;........|......I.......,............................{M..fYu.....q...................................&...&...&...& L.&..o.56...&....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\delete.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 192 x 192, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):453
                                                                                                                                                                                                                      Entropy (8bit):5.6618159951094045
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7nard9kX7YIw6JGrOVex/6sFzSrfq/h:Oah9o7eiwHF1p
                                                                                                                                                                                                                      MD5:CDAF9D3ABA7E627290B2D4C812227373
                                                                                                                                                                                                                      SHA1:C50526CB2037DE682FEB2F879AA01FAD61483A2E
                                                                                                                                                                                                                      SHA-256:9C9373A55FA1AB543CFCDC80308522C677D517DC4837628891B97F66DC96E7AC
                                                                                                                                                                                                                      SHA-512:799445D97083E44567B63914AC62517216B5A9515BBEE574CDD01FB6A8848B089262A6B2CA6510FC3BBC14896EE8571A37BA1B8DD64C5455017CC87DDE26FB5B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............e..5...EPLTE.....................................................................R.s.....tRNS......-[...............4?.....IDATx...q.Q...3....RSBP/._....>.$I.$I.....|.Z.........yAz.Z...d..............>..@ I.:........................................................................x...=+..]+...+...*..m*.........`...w....4u..F4?u.....t..........2...6.....v...j../._........O.....E.+I.$I.$....MH..r....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\digitalbitbox.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2964
                                                                                                                                                                                                                      Entropy (8bit):7.88984074103265
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:9D/66ZAaiRvAFzDm2aDpXcMwf26VAqVL7Lgi4+ASvC8g8t+:lS6ZATeJm2kC/Y2C8I
                                                                                                                                                                                                                      MD5:4648FB45C35D90272841644CEC7F5772
                                                                                                                                                                                                                      SHA1:F2D0C1B4EA9CD8F1E679923E69E3EBEBF2506200
                                                                                                                                                                                                                      SHA-256:8717CBEA4EE2841D109027C98253177562CE60D75C2D94D613E598509FA37C0F
                                                                                                                                                                                                                      SHA-512:5841D71841AD3190073971DE7F8218C657D84105B671DC0F641224C0CAA889F1727E65544BC89FABCCD29B8D5E8FF358759389DC09803604A82302C913B80B2C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...P...P............bKGD.......C......pHYs................4IDATx...LTW.......f.l.........].HlH..%..v[3.%.F......t..5.b.u.5..]-Mhuk..Mj....v.dW,;...E(.u..8..v..7.....L2..{....{..0........q.u....0p4.N3.4.S.7.Ar..."}/..eY.,....7obpp..'x.6.j..".2.\."".s.......l&..D[.lQ.\..e9P3..p.<a...QII.. ....I..+..~.i........?.xN.Sy..{...+.P:...c.g..q..|~....w.Um..fy...4{.l...h.....8...!A..,.....(..t:..yZ).....f3...E. .......... I.$I.t;.$A.E.<...A.......O..m..8D*%..P.....j....j.5..h.5..@..&.@...P....P.....j.....V..*...P...w..@.B...2........c..S'$IBcc#.....y..^L3...W.GD.m.6.3g.Rq.I....={6m..DQ...p.@;8^._gg'.....M.....c.y..>..S~...dFZ..~Hyyy.,..B.N..g.WNN.....^....J.C.A..OSRRRX.a......TWWG.I..........TUUE..{/. ..T....g-aJJ.UVVROO.......I.....[.z.j2..JM....8..@..4>>....q.....A.l..p........I...J...U....PE..B....Dz..'........=JK..U....S.........JimSS.r.3.8...w/...+..a.:...... ..D.....n.>..v2......=.>..........o.!.a..-555.........y..)U..,{.OI.h``.J

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\digitalbitbox_unpaired.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2549
                                                                                                                                                                                                                      Entropy (8bit):7.877892167190726
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:9D/66QSPFWXHpielhcyxPFuOk9YLyowam9BSZuVNLeqCJ2GnWGE/XbwwLRVN:lSaIXxhcyxPMtswhBSwVj9GnWzRlr
                                                                                                                                                                                                                      MD5:48E5661CC85AFD4584870B031E82F2CC
                                                                                                                                                                                                                      SHA1:CBB45299465B71FFBF2124A0C318AF434FDED003
                                                                                                                                                                                                                      SHA-256:42BB7B322669B0117F1E354909B64D48D0C0CEC775B700118632175A782F3B2F
                                                                                                                                                                                                                      SHA-512:8D886C189309AD7012A414ECD9F607D53479C2C5170B0A7691D13989C4208757655A07C6AB46B0B66E4CA53B85060F010ACD1B4D927B7A02B6686071668E3645
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...P...P............bKGD.......C......pHYs.................IDATx..[h.[...L...XSm..l..|.T.=X.R..A...E....h... .|....**Z+(..6.A...'.mKZ{1.V.F+(&s......L..[f...`.I....Y{.....p......~.}..8w.}W...a@_..8....."H~.....M..,.$.2......>}...}5.p.....L.e..A...o.PTT....8.N...}...!.r...r..0....a......6..6....u+.^.....,.%.......W1o.<..b...8...8.<.^.?.W.\.{...b8.....cAD.@.......x.".A..?-@.[...Y,...S{..j..!%%.MMM#.....DD.....y.$.$I..u$I"Q..j..O...w.V...9.k.<O#...d....h.4..f.4...M....M.&@..i&@.....h....h.4..f...z70R*..].%p..\$Nz...mV..?A......l.$I"..C...}.S..n.........}.0n.8...A.a.;...M.6A..~......?._[[.....:i..u..q.FK.e.>Z.H...v..-,\....y^.p.@..^yyy.~..FK8.^... ..{..RSS..F....\.\.v...a.DQd.dWW...9.)S...`.Z.....Pk.'O..C....W....Q.$I.....,]..)))L.|..(N.....&%%a..x..O.AT_...a..,(dgg.........tW..;..P.{.1X.j.........Y....-Bww.q...=..O.<a.....c....@.....v..D....'O...+.w|..1...AD8...q.O.>...;w.....:.....HMM5d^.8..'Nd*~Y.5.S.$..~..K.d.......{.Y....

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\electrum.icns

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Mac OS X icon, 830527 bytes, "ic09" type
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):830527
                                                                                                                                                                                                                      Entropy (8bit):7.988734354922088
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24576:4VKk/Nu0LACehvYVzrFodFCJurMCqJPYXnVnqzZBVKk/Nu0LADR:GV0vA3rJuwR4nVqzZJVGR
                                                                                                                                                                                                                      MD5:2B8025B601932267D73F0575FBAA300E
                                                                                                                                                                                                                      SHA1:7218DC0CAB6A228529FD9FD498C29FC6B74BB9CE
                                                                                                                                                                                                                      SHA-256:B4F6CFE5334B31314C0E17C6B12661D2A559465D5D90C39EC882075351B2E0EB
                                                                                                                                                                                                                      SHA-512:78CBF22FCF4E74BCBE39F99A32F002C7815B297A61B539DAC85478A3FA9D87456E18DD3C4BD545C499C9B67EA8BC5CF9E55474AEC636D691485ED9469001A258
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:icns...?ic09.....PNG........IHDR..............x......sRGB.......@.IDATx..}..]E.....N.;+Y..v...(....w.t...:.:..,2...........+`..\f\0?*....d_..d.N......N...{.;..^'UI..Nm.:..n.".D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."....@D "....D."......G ..Y..#....t..g..Rc>...G ....*RF.".....i...dE.|y.,.6......<5o....A......9.\..3.s../6h. ..+.i.X.i.@..X!..+Y.<Y..4MN>O.7.)M..M..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\electrum.ico

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:MS Windows icon resource - 7 icons, 32x32, 8 bits/pixel, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):63932
                                                                                                                                                                                                                      Entropy (8bit):5.998406396761299
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:2Bm/HQOYfp/9DRbYlbJskBsIqZ6zsS9ejNPRBTIHW1Q:2BUHQ9polbJXBrqZ6z4lPaSQ
                                                                                                                                                                                                                      MD5:8AEC9FD7C3D563FAED700948BB821327
                                                                                                                                                                                                                      SHA1:8ACEB0D85B7F08041B411A9AA4136B561C05F3CF
                                                                                                                                                                                                                      SHA-256:2C4FE327580AAD0AA4B30FA15B2770BBBC0736D28C849D1B66C6767127697C4B
                                                                                                                                                                                                                      SHA-512:CC3FFB0A841436400A41BC6C4A8308139B83822D0AADAEF429111E326C72433B0BD324F4F6B810420CB5B3CEF855DC32268FECA5CB4F0D80DFF33A8CC2BDFAFC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:...... ..........v......... ..m......@@.... .(B..$v..00.... ..%..L... .... ............... ............... .h...T...(... ...@................................hB..hE..gJ..k>..n5..r/..jJ..o:..mB..r2..jL..p:..mE..lM..q=..w+..nI..pD..mP..z(..v5..x/..sA..u=..}$..y2..tD..|,..v@..tJ..rR..qV..}1..uM..rX...+..uQ..zA......xO..u[..~A...:..yU...#...0..xZ..{S...$..x_...A...4...M...G...;..~X..}\..{c..}`...6...K...C...5..~f...^...+...,...e...[...a...<...e...j...7...8...f...D...[...I...n...N...;...a...]...F...>...r...Y...e...L...v...l...q...X...J...y...^...|...j...n...s...~...m.......}...x...i.......m...[...........f...........m...t.......{...t...........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\electrum.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):24089
                                                                                                                                                                                                                      Entropy (8bit):7.979796035819619
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:qlD0+FRH+p+hd2dSNjPXbf3dPX5lbdVdw8M/wd/H74:qlY+FB+8hXjf3PVeXwR4
                                                                                                                                                                                                                      MD5:2F9FB1639D1729737DD597193DB2902E
                                                                                                                                                                                                                      SHA1:F418635F30225415734F5E0629CAF14FD28840FB
                                                                                                                                                                                                                      SHA-256:0B93801E52706091B5BE0219A8F7FB6F04A095F7C5DD8BF9A0A93F5F5D6ED98E
                                                                                                                                                                                                                      SHA-512:FBFEA5A7E2AB2AA9EFF6772C488F47E4BA9DF0923D8F395EAF850612FAA0CCD1CB4F12C620A876D909C4859C97FFA30B20A91BE16B163471441F84D5E22FA8F0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............>a...9.zTXtRaw profile type exif..x..iv,7.D.........`.sz.....H..T*..5........|............O.5.rm....O....s....'.?.d......../E~....|^?.z....>_.......N.\...F}r...sG...p..?.w=.?...q>.....~....Se1v.z1.p......'E.".8...>.+.?.X.5......O...O.X.g}...-...c.?....>....*..#..?9.vGo....~.......>.H.\..P_.b........3...o....g.k.G........>......_.b.'T~.a.h_k...V.[.....?;6vb.s./..{...]..5>y{^.<.c.........].}e..?.{... ..6.s..W.!...i.........mld..-s...3.%f..l+.>.';^.../....X">;s3>..O.1...B..ul....CLa..>..6w.R...iA..{......6"."......r*.[...1..s.5...(...K)...F.5.\K...^G.-..J..Yo......z....|.H.k.^?...3.4.,..6....Yi.UV]m.5v.q..n.]w.}....t...z..g........mo....}v..]..........(....5.\..%..$k...<;^...t.=...s....b.....c.`:>..........X...o..v.i....9....s..o..k{..F. y!k.BF...6x...J..;.d.B.......-b.}........"..O..Wp..%....t..w~...WW.Iz....|g...7...|6.W.*....W.......^...g.7.....N..Dld.........s..M.z.......M,.+;.....8/[..;.../..*.Wn......

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\electrum_dark_icon.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 32 x 32, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1268
                                                                                                                                                                                                                      Entropy (8bit):6.37699756090789
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:h8cNNOsb4p/6jaX3jBehgZ+RN2plWwIlP1EvVkROCU0IW:hNNo1p/6kX+RgEQ10IW
                                                                                                                                                                                                                      MD5:3B5D3CF1678F1B2C1B24D0AF19CA3CFF
                                                                                                                                                                                                                      SHA1:F1FD00A7B2B059FA9C672BCD5FE09EBF8150A8C5
                                                                                                                                                                                                                      SHA-256:37F2A442446F7AD873DD3A1AE99DB802E138BC931E30A1B5BC8836C77DE550EE
                                                                                                                                                                                                                      SHA-512:A73E459A288F62B9659A2A4F8AFB101875E89E2642AE93B3A93B76C56B1FF5E427380F9531F5DA9E922F38BF354D6B99D8D160CA619AD95DB57A9623EA61DA41
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR... ... .....D...... cHRM..z%..............u0...`..:....o._.F....PLTE......995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995995...G.......tRNS..,....#.............%ur.Z<..(.{....[Eh3g......S@;.n.)....:.....6|T....z~. ..O]...b.4....&t....QFm2`....Ds*-..p........$..>}....bKGD....H....pHYs................7IDAT8.SW[.@.."..".....A.....Q.b.^....w.!Q...}..a....&.)../....5....i.&.U..,./(,..........k......e.z...q(7Rj(+U.L...f..,.....JH.y....R!0.&.*;g0p.*..`V..p..U....x...zq....[........:.f..&.mn.......}hi..&.,.....p.[.~.Spw..P[P.D..].n.....#.X..v.@.0.}.....Ah./....'....2C....FB.. .....a.1.q.36..Q ..1..G.L.=..R.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\electrum_darkblue.svg

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7661
                                                                                                                                                                                                                      Entropy (8bit):5.121643197322132
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:VkLIvrtV8H8yJoMH9mfL+RgGEVqo+RgGE29b+RgGExG+RgGSeJFVFNVq:mmtcx+MH9TEqTEFTE5TlHD4
                                                                                                                                                                                                                      MD5:40A5D164613BBC21908D960A95C59BBF
                                                                                                                                                                                                                      SHA1:803C4477F54BA3C2F177FC38182FBCC4C3A69294
                                                                                                                                                                                                                      SHA-256:D11761E14256E2833E5F18EF84D1E39F945AEEDB82313D4D69B713D3DBA1946F
                                                                                                                                                                                                                      SHA-512:6E4857974F037B8452B96EECC77C57751027DEF65174443F88F57C9CF4BFB314B31502611D1F8426B0E0F6573B92FF6CE24497C3B0F90DF8819A4C717A4BB506
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<svg. xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cc="http://creativecommons.org/ns#". xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#". xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". xmlns:xlink="http://www.w3.org/1999/xlink". xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd". xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape". version="1.1". width="779.8111". height="779.8111". id="svg2". inkscape:version="1.0.2-2 (e86c870879, 2021-01-15)". sodipodi:docname="electrum_darkblue.svg". inkscape:export-filename="/home/voegtlin/logos/electrum_blue.png". inkscape:export-xdpi="10.014582". inkscape:export-ydpi="10.014582">. <metadata. id="metadata53">. <rdf:RDF>. <cc:Work. rdf:about="">. <dc:format>image/svg+xml</dc:format>. <dc:type. rdf:resource="http://purl.org/dc/dcmitype/StillImage" />.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\electrum_darkblue_1.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 67 x 67, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5255
                                                                                                                                                                                                                      Entropy (8bit):7.94512021036659
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:87xJ+McLLltwsKBXQ/saCFjHEc0TBBMPHaF5TKvPOlu55w7GxF4:87+zLLlVuQ/saCNj6wH2TgPOlomuy
                                                                                                                                                                                                                      MD5:340DF27632B9DE46EF15C1FC98EF9674
                                                                                                                                                                                                                      SHA1:EBB2A8385B7933B9F8F4EB71D577604CEFF067EF
                                                                                                                                                                                                                      SHA-256:E95228EC7FD1C019E2A4826186A440F2F806FC984653B06F56F0A4357A9774A2
                                                                                                                                                                                                                      SHA-512:4E8E71ADFEB5E62063E891B8C2CBB136BDBEFBB4951E90C12E9434A516413D461E8F0CA75D297F58A4EB9C5A65DDB51C8C92113C88724F6173DC61972E21A179
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...C...C.......s....pHYs...D...D.M..\....tEXtSoftware.www.inkscape.org..<.....IDATx..y.T...nw.>..(.1.qI"Q3..`..(F|... "D..{D.A..%.'...h".3C$n.HTf.D...-....6........r{.{.F.'....s?..9..~.T.S.*_.G.?..O.%.>.|..d\S.=8........K.......".?xv....D..:.D......v...s..B].1.^....^,...<..A...9.>.2..uXs..a`@/.N....4T........U...pB."...#fn..~.U.i..C.kP.....q.=K.......].C&..J.F...%F.a...`.n....:O\_Lq..q++........G..S'z..M.R.F.......`.jv..a...:.....a ..-F.:$..5..t.....UTg..D.X..tTF.I...F...@dj.....\.3..w._.b.R.r....*`>.J/..U.2S...7p.0.(.=...E.H._N;.s....e..U..A.v..2.W|.6..,.~...L}..h.G@i..q.kN.u..!.w......D.W..B....o4?.../...=.aW.I...R@D0ra>..6.7jCx*...n.....Z_3-W .t6......,G...|.va..S|7...... .5.......z...rh.Z.~...O.).x.Q^`H..E.wR%..|+......4P.*.5..`.>+....W7*.|wc..?..#..e8.....4.#..+..<I.yR.+..f$p5$.[.*...B..=E...t~`X...m....S[.C.r.<^....._.hC...9........Ln.z.uhcx#.,0i..)........r.;e..8..H.+..jc.^?..W/@..R.2....3...8$..<...*...%.o.....}|z...

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\electrum_launcher.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 136 x 136, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):12312
                                                                                                                                                                                                                      Entropy (8bit):7.968450055550998
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:R6Xu25TcIdJUv//QTtA7l6sLH6gw0s/D8wUQv:R6Xu2Fcnv1lFLbw1Jv
                                                                                                                                                                                                                      MD5:59D6607E00BA5A052AFCC211560F87BE
                                                                                                                                                                                                                      SHA1:67198BE2EDECCE3377EA08935C1CF39421756F5E
                                                                                                                                                                                                                      SHA-256:EB6AAB81B500F634F1395A497BF8A580E8C9710899087F54BE5CBB3742120F0F
                                                                                                                                                                                                                      SHA-512:54A561AEAB356BF126FDBB3C349D69D900A79D05F421C3FA66052951D297F92980DEFDEB37ADA64FCD1249A92CE8A6BB0DBD56C9C9E2321238672F2685FCCE87
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............<..R....bKGD..............pHYs...T...T.7..R....tIME.....!.TB... .IDATx..}w|TU...s...lz.!$1.$....H..J.E@@P@.. .....(".."..E..A......j....}..v.9.....M(O..Y......sf...A...4Q...n.A.5......DM.i.&.4Q.@... M...&j.H.5....2..b<p..:".f-A....>B...9.L%...M.N.#.V'.g".F.2..L..]b@...dJ/.J]..6.......K.J..y.^;..P..<d.v.ct..zf...vC..Y.Q.\......G.../.%.a%...=.5n.'..tG.T[g.)%...G...N......!FZtpe^.x:r.r.5...9w.....#.:T...0.W.po..$27..\.}..c.Rz.L^.@..~...8.....h.j...D.._E.6./^....1.&".K.......~Kv.s... ..Cq..e.4(QJ)...w}.../.....wf.yw....E..F..%.....:}.....x..>ra..D.7......!.T..(.. .=...l...'..........5...Q..o;...K...... .s....g>.e.R.!..........K.8..."3r.. .`op..A.....h..b....4a...._.....(..x$U..QS..>O.S.@Az:..A...@.$E.7%.o..<.....h$...2`.]_....... (,...`..\T0&}*.|x....8{.V..J.{.......Kx].t..=.o_.-.q2....tvc.|4.i...i...'..KG....+:._.*.f...U.W.L. ...F~..S..+.@.....).zu..H.Xn...(.\....r..^.A.m.!.&.N........w.y.b..v}.K...{I..c4.\~....!e

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\electrum_light_icon.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 32 x 32, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1268
                                                                                                                                                                                                                      Entropy (8bit):6.575111062657472
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:hYNOsb4p/6jaX3jBehgZ+RN2plWwIlP1EvVkROCU0IW:hYo1p/6kX+RgEQ10IW
                                                                                                                                                                                                                      MD5:F1682140E4059EB2AFAB3FD9146F11D3
                                                                                                                                                                                                                      SHA1:837D7266F349E13F178A62A7254E9E7BEBE68D2C
                                                                                                                                                                                                                      SHA-256:1C947F78BF19CB162CDE0B53EA02C2E39306D0B918B53E82457B1FF5565F0127
                                                                                                                                                                                                                      SHA-512:E719D3FC5B57EBD12528FBFF4008D0FA91B04EE725EA0F49E22501B10396396822FED2995307FC38C790D25FEFC7E1C7E6AF40151672D85CDEC5EEB990A5EE86
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR... ... .....D...... cHRM..z%..............u0...`..:....o._.F....PLTE........................................................................................................................................................................................................................................................................................................................................................................................................................^......tRNS..,....#.............%ur.Z<..(.{....[Eh3g......S@;.n.)....:.....6|T....z~. ..O]...b.4....&t....QFm2`....Ds*-..p........$..>}....bKGD....H....pHYs................7IDAT8.SW[.@.."..".....A.....Q.b.^....w.!Q...}..a....&.)../....5....i.&.U..,./(,..........k......e.z...q(7Rj(+U.L...f..,.....JH.y....R!0.&.*;g0p.*..`V..p..U....x...zq....[........:.f..&.mn.......}hi..&.,.....p.[.~.Spw..P[P.D..].n.....#.X..v.@.0.}.....Ah./....'....2C....FB.. .....a.1.q.36..Q ..1..G.L.=..R.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\electrum_lightblue.svg

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7510
                                                                                                                                                                                                                      Entropy (8bit):5.122849632068533
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:VkRIvrtwS8yJoeIwefLaRgGE8qoaRgGEV9baRgGETtaRgGSeJFVFNVq:mUt9x+eIsTETTEuTEMTlHD4
                                                                                                                                                                                                                      MD5:663AEDB05ABE2CDDF526BB2E16F282AB
                                                                                                                                                                                                                      SHA1:7576696B929E9D73278207AA4C8DADBAC60D6F57
                                                                                                                                                                                                                      SHA-256:8BB443BD471F039A1900FE5D04147A8A96FB44A0BB830C1A9117C4886DB69CAA
                                                                                                                                                                                                                      SHA-512:3DC3A4B256F3197F64D3EF2BC0F42F4440B659F412CA9E1D480174CD40072AC3B36618DF13346843C0CD72CADB56E644D41A18909E8D131FCCE6BA301B2105E6
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<svg. xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cc="http://creativecommons.org/ns#". xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#". xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". xmlns:xlink="http://www.w3.org/1999/xlink". xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd". xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape". version="1.1". width="779.8111". height="779.8111". id="svg2". inkscape:version="1.0.2-2 (e86c870879, 2021-01-15)". sodipodi:docname="electrum_lightblue.svg". inkscape:export-filename="/home/voegtlin/logos/electrum_blue.png". inkscape:export-xdpi="10.014582". inkscape:export-ydpi="10.014582">. <metadata. id="metadata53">. <rdf:RDF>. <cc:Work. rdf:about="">. <dc:format>image/svg+xml</dc:format>. <dc:type. rdf:resource="http://purl.org/dc/dcmitype/StillImage" />

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\electrum_presplash.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):25916
                                                                                                                                                                                                                      Entropy (8bit):7.660462274725344
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:UluH3NJNR+2Wj1/EzC89IOJIzki8fhNr/s0zLHTHX/9218udkr:8o9Jbu1MWMJIzki8DrkWbXF2rk
                                                                                                                                                                                                                      MD5:E2AD368C2AE3B70F2F9A36B0C62144D5
                                                                                                                                                                                                                      SHA1:E13FB5A28014344A78832AA376558CCC6CF36B65
                                                                                                                                                                                                                      SHA-256:D738781249BD3308EECCD00537FE44D1A145E6B18832338390FBC85DC15E35FC
                                                                                                                                                                                                                      SHA-512:F86557240B73F9DF955D6F3BF30A96D67D061CB97CB53814AF2E3138C38767BDFA29DEA6E67C02FDC3626CF69E4775E561CB1AB88E7EF493CB591EFF21400D72
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............x.....qiCCPicc..(.u..K.@..m-.V.. "...C...8j...)..U..B..K..W... ..k.?.UpU..E.qs.."%.k.-.py......w.?.3......l*)....w........m-d2it..G..x..^..:.@A....#.e.w...[.%x.x......q....o..x.&...`....~.S*.......i.WX.<.&!.\Y.<Fk.6.H!...*...1.&../..-.L.F..Upr.Q"o...uU)k..........$..$.|u..I.w...\...u.g@...6[.2.i..ZK.......)....0.l.\nH.Z~M.>...<0|...{.j.....m.....G...7...|h........pHYs...T...T.7..R.. .IDATx^....E..w.... H. .N......g....& .H..E.Fo....Q.}.....:....!=...........n.rw...v.;.7.....3.R..@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@...... ...@......

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\electrum_text.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 326 x 67, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7439
                                                                                                                                                                                                                      Entropy (8bit):7.950993607765179
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:a254DuRPm3ML7dsr6VPpDLwxTUob1J0GNjau:a2WDcm3yagLM4oTNWu
                                                                                                                                                                                                                      MD5:BB1928F3F68D01269AAA1EABDAB6835B
                                                                                                                                                                                                                      SHA1:6A3C4F650AD3ECA30512769D0B1A2400940E2DC5
                                                                                                                                                                                                                      SHA-256:55BFAB6AF8D6C82AF2E039A1F02210AA486D572E96810FE533B01E63DD4F2666
                                                                                                                                                                                                                      SHA-512:25E4B06DBB51E42F37F32905054E74C76C70CAF27253282A0E85E20F853403817CE3F2734FE42DA21A3AF62FB5DAFE95CD0B77E280069448E3837383142BE284
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...F...C......m......pHYs...T...T.7..R....IDATx.....E..........9.A.PA.8..O.(.D..."H.%|z `B.;=E..=E%.H.I$.%'I...z.wgfgfggg.......\OW..VU.lT...a.0`.0........a.0`.0........a.0`.0........a.0`.0........a.0`.0........a.0`.0........a.0`.0........a.0`.0.......4.@.P[...O.3e..).o...s....p..F....r.q.....l.G...+.6..dw.c..I.)....L.6..$..{n{...$..T@...0;.Uw'...'L..s....r.a..Z.L.M.j0.dv.lE.Z.V$.R..*.N.u..].. .R.=1.[..J...K..a.+/'...k_ll....i.c....?.}..Q.Q..F.>..M....|.geG..W.v....Dv.se.J....t^...C..W.x.>K.....X.m.X|#~AK..?&rs./W.\.to.&..u.[.'.q.g..J]....:mu\Qc..O.y8fR._._....'.LB..PW[-w....?.X......I.|.[..j..6...o...IN..b<...Q)q5N-...?..s.F.=...t..X.P.U...Z..B.q.:8~.{..@9..*.....$.C!y\.8y....y...BVv.?a..H......>...^!.J..O.,.}...6."..q.(.D.sxws..&.</..[.c.;.\j....S.........g7....g>o%.. ...........4*=...!?%t....q..gE.".....r].n~..].<.K.0..8+.UJ8A5N........@rK.=#ikw...h..p.6.........+..hj..:....l..>.u....D1..(.....ST.).......@.&7...K_.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\electrumb.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 163 x 148, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2510
                                                                                                                                                                                                                      Entropy (8bit):7.888842297003142
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:cB/6mGU6ToQRR/Q3gmPQ5mV1KP1GweR4IrndDuZMWTQ8NUXLXNovrTaSrJwSOndU:+S7hbDWgmPM1b04Ip6CWTQwcerrJwSQW
                                                                                                                                                                                                                      MD5:9BAF924AC5D7086FE1427B8E16825707
                                                                                                                                                                                                                      SHA1:349F180EC748B6E9677436244A836C8BB0A07224
                                                                                                                                                                                                                      SHA-256:FE3926386E4EFAD5EC7FE9324509E4A12C703417FBCA7EFB8BD03C435B1C23CD
                                                                                                                                                                                                                      SHA-512:AD2120D1DB9F6869F9B65FC0217507653F7E2C47B597964E3017C6CA5E07382ADA0FF20D14BE93AF2C3637DF22C4C049A11758FDD0F095122196485E58182E43
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............U.Q.....bKGD.........pHYs.................tIME........"...._IDATx..]AhVG......_..."....@.K"......A/5.(h1..!A""^=y.'.....K=$./....F"B.Q.'.hM.O.Cl..........)....~.....]..RJ)...B....m.-<.&...UlF#6.X.K<..f1.g....c.-a._...<.>.T.9...I.....=..Cl!C.....^...[K.;.wm...m.....6.....7.B...i.WV....p7.D..-...8.<<....ch..y....HC#7..).[.0...x.w.xA..2.....vn..y.........P.M.x.K.8X%.4....s......?gv.h~...f#w.O....:zw.e.?3.T.!?...>Oj...>..Z<g.).....:k.-..G,+....N.).....k@a...@....32...T..8.?..|A..*.7..O.+ ..yLh.......A....H..\.>.O..@.1.)..M...1.B66.F_....YL...:...H-..kf..#..N..Y....-....9u...K.. .#..i.B.... .r...w.e.Mk.v...2u..9|u........J6rw..!B.._T...a.....G.V.z.m.5.R9..Q7.2.......[5..pjn..Z8.?..jt...xH.... ...d.....#...y0RSc).#.....@.......>\.....Q1...9...9...=e..X.....,$C..j.H.d|..8`......A.ko...E.`...0=.....d..c>{.Cr/R.{p...2....n.k..x.1.ZV..x......{.....>.....'M/..D..U.f....^....S.l.e.T...Y.".:5...8r..%..D..+.`.y...f

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\expired.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):28522
                                                                                                                                                                                                                      Entropy (8bit):7.923983218809425
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:7wsMky1PGVyYNHwqMXl0QO/34KIu6/gShOdE/+ljF:7wswGVyVqMXeQOgKIzPGljF
                                                                                                                                                                                                                      MD5:68AE369A54DCD7B6D0420C6E980E6A03
                                                                                                                                                                                                                      SHA1:D16551DBEAD0E2F01154D4921514F67FBF868DE6
                                                                                                                                                                                                                      SHA-256:21FD0371214571ADD1005346F98391C8A05AA5F3116ABBDCBDD06E54EFBDE606
                                                                                                                                                                                                                      SHA-512:4ABF6BB49856E8316D4203061A94D8BAF666102877CD374331FA8532DDB2BE21610E4FBA3D745C59E26C977C7EB64503954AB16BA1866C7A4077924E01980BB2
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............\r.f..o1IDATx..]...D.>.-...oc...,u.E@P.R.)UD......`....P...v.".O....(XP...m,l...s.$.z'...@6...L....9mf......J..m..\.6W7.`....%.L...n.m...2.w.A...N?..d...70.z. ....q...@...]..B#.D.......n...H..:.f..Z......>.w{..je..vn./0C.6nO.K.l.........2N....;..;.........R...M...b..nw..l.....q.. .w.....W.6.w~...v.Of.oq..6$.....q..8..I..{....m.w....V. p2...?!!4...^... A....Z....~n.=...S..+q.k.d.......^n..q..Q..e..8....H....+'M...:.~.d`.x+....@.....w....ia.l.j}x..+~..o.D......e..R......p.......;..........ZA*.'.......p..n[..{..E.]P.!.:Z...ZA".'.MA...........e.u.X.f.R+.<....>..#...B....'5.(#"9'.l.v|;....>.Dp_qw..2N.!...vy...Q..R.5.{......O..h>P.%zW...'w.J.....\..d....zil........d... .....v2.Z..{ny.-.(R.....a=Q...l.......O...W...)...2...}3gBe......i.<4..d(O.........R....>0.e0(g..n......M.l.....5V..UP..e.[..F.-..g....../w.M..[.o..m..F"x....z.h..N...^...mF.:....N..S^./L.}w..fk.=.J.'!.;..m..ct.......a...a........c.....M.ji$..._..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\eye1.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2910
                                                                                                                                                                                                                      Entropy (8bit):7.909019751618405
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:/Ud8vu7I4tXacl6KlvRpOrDvig7gH/BpjemizVZWAa15ZXH2JX:rvu7XKWBkD6EgH/Bdyfo15ZXyX
                                                                                                                                                                                                                      MD5:AF5E1B19B9DD704F021416857EFA8B13
                                                                                                                                                                                                                      SHA1:4ECD31A78CD4EFB2AD4F9D9E6E81B37D4BEDE078
                                                                                                                                                                                                                      SHA-256:C94D800E645AE2E63A194BC67772E5401848BDF8BF664F102F39D67B76A53ABA
                                                                                                                                                                                                                      SHA-512:62370880FE43334DCB37F1F167391E44D55B1AC843D15A46A6D243AA79C8AE1935239676E896877FD39F99293CE063A7F20229D8F8B616260F4111D67DBB2768
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...@...@......iq.....sBIT....|.d.....pHYs..........u85....tEXtSoftware.www.inkscape.org..<.....IDATx..yp......Gv..6.M..9.JH.\*..B.....`....N.aj..Z..E.k........p...i..r(....H.Eb....^..?6..fw...?............|..|.!B..."D..!B..."D..C....Npi..T..U1...V..U.V.7o~...?X..O.3g.2Rj..$L.&....!.uJ....../...[.5~_}....\r[."<..b>RN..K4...\.6.\.}....O....Q<{.,U.....C5....F.....x.=..=x\N.C........k.1.S.R. f.,..!~...,T4..31%&{.#...c.5.^...,.f.X.........m.*Vs.....(.Yx.*.W.rb8.y....{...n...Q.?E.W...._..[7U...@s..n...C^~.3R......Qz=.....?..+..:.BQ.edY.q.<.......F...tb.K..c.l...h+U.]9y.LcsG}R]]..i3......Y..s..,....u,.m!WO......`..g.us......-..1).IM`R...v+.t..mK(.H......B{.IT.7h...g...?Q.....q.*.s.r..VW.........&%[...tQA>O>..._{.o.......dL....)....O.(+...(...#..m......!&..3R(.n...h......@{{'..X.M7\GSs....|UR...;.=.N.;.m..V[.9..$..Fz.PX....+.#3#...F.....0"3/..9&*.9.H...?...;.pd.8m]...h.#..O....P......ILL...../...V.*..=...lX.0.d.<..'..`N....e..[Qz;W]s.?'.,.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\file.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 256, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4779
                                                                                                                                                                                                                      Entropy (8bit):7.489422017671005
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:NAlOXNL5rVVdr5VgoMaqxcY/kY3SVfAD4I3q8UispwTwI5:uytrVVdNmX1/opi4I3qMlTw4
                                                                                                                                                                                                                      MD5:897DED1ED1153E7B0836E8898300E82E
                                                                                                                                                                                                                      SHA1:41A7F5CE4CEF08B5D3994B40590F1C60F7AFBDAC
                                                                                                                                                                                                                      SHA-256:6FA888B5F96C290F66AACF2D902F6B17B7E386FA4BF0BF2C645CA8721480369A
                                                                                                                                                                                                                      SHA-512:86EE44953A89BC9DA715C9A7B68B4376D2BD38F14DC5072EF590F8BB70C88C2F68D1231E4D418290B4D161E194B75C270AD2E0125AD7DD7262F4CDE2675FFF99
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............k.XT....sRGB.........gAMA......a.....PLTE....yD.zD.{E.{E.|E.|F.}G.~F.~G.~G.}I..H..L..H..M..O..H..I..J..J..S..T..I..J..K..J..K..L..M..K..L..M..N..O..M..N..N..V..P..X..]..^.._..Q..Q..R..S..P..S..T..T..U..P..Q..R..V..V..R..S..T..T..X..Y..Y..Z..[..T..U..U..V..V..W..W..[..\..]..X..^.._..b..g..h..i..`..{..|..|..}..~.....X..Y..X.Y.Z.Z.[..a.[.\.\.].].^.].^._._..a.b.c.c.d.d.e.f.f.g.g.h.h.i.h.i.k.`.a.b.c.l.m.c.c.d.e.n.o.e.p.q.q.r.r.s.t.v.w.x.y.y.z..z..{..{..|..|..}..}..~..~..~..~...........................................................................................................................................................................................................................................................................)`....tRNS......................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\freeze.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4328
                                                                                                                                                                                                                      Entropy (8bit):7.917063105549831
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:5eKnaW8i7leOeG+O8WZxBiXAazywYTtvD0AnR3dX4wpNOAvtz:5eKNl8GT8QXYz+TVn3phtz
                                                                                                                                                                                                                      MD5:F2BEC482842D6EA87DA2610701D348E2
                                                                                                                                                                                                                      SHA1:2AFEBDB8BE30D7C53B5740D10C90A8DA1C0FD1D2
                                                                                                                                                                                                                      SHA-256:F3C9D70B977D5DCDF883D07B14CB48D731EAB28C9388CE502F33A2033930FAFB
                                                                                                                                                                                                                      SHA-512:ACA1DDABAA177FE36EDD753F6E77652861E1329362A5D48FB261E8A15BA972A12C466CDB161B5E99878CE92038A1BF9B3DE5E529D784A550E86674E13681B04A
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...x...x.....9d6.....pHYs..........o.d....tEXtSoftware.www.inkscape.org..<....uIDATx......}.....!.&.z..D1.Zm..m.Z"M|)...m^BP.f...A,"h=.@.1.........e.%i...T.Q.kTD.....&...1....O..x.w{.3..._/.`...0........eJ....(..e.K...%NY...,p.S...).\...q*....q].(E.p..i~...OGsM.I......g.w.0...+py..q...8e.K...%NY...,p.S...).\.....K..R9.s..3f4.....X)Z.b.msyXs..5...1cxs.:>..<aR...6..7..Dx..y..c.s8.3..e`...F"|K...(..V..........qp\.?.b8..,.....g.....8...v!(:.m.."\=.J.T..CK[[~...e.........1D......fE.X..:.H.!.@G]./uuqi.&+....x.0.~M....<.[p....m.Y".s..%......`.VVr.5..<.Q.........V.8u$..OH$X.c...h.^....V...KyL..*..r..[.m.Y..?.q..F..m..1..KEX........u`.i.....q.e;...=......#B..s.........X.XE.+..*@B\..J..D........mmD....@2.t..V.....jn....e.Rt..k."-.w..E............Q.i.../...==.....M..i..B...s..;Z..D.H$..8,^..j.6...i.....J..|....._.,.[...q.9c.|.u.b...8|)....wu.g.,.S..*^t]..j...g.?.eY*.$......~.h...T.bK.k...v.8..ExU)f.".A#f..nk.H.Y...9...A..X.S...Ks3.4M.(.t....?..0

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\globe.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5938
                                                                                                                                                                                                                      Entropy (8bit):7.882084294102423
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:IgbxssDKO3kLnQxyCyVap5OESodKg1XgZPvabCWtM7qZNCoqmWEEOHr5gj9H62:IgdsQKlkxnyVapR3NwZvOMYCoqJPO6F
                                                                                                                                                                                                                      MD5:F4DD4CE45C589748F88A7C8DE1F476EC
                                                                                                                                                                                                                      SHA1:268107F65556A9B5F9862A2DF9190102E25D80F1
                                                                                                                                                                                                                      SHA-256:88EBD17E7FB233C4A26FE09CBE08A53AA80544DA531A751B273B53E94E03F980
                                                                                                                                                                                                                      SHA-512:D450CC29CDB98BFECE9243C237D6E975BE2A1B3C72325315A9903B369C6E420968A634494F520931B807A48AC61AE6CDC9FE14EAD1EF6E2A2C8A06BC79E9929F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...H...H.....U.G....gAMA......a.....bKGD..............pHYs.."s.."s..*......tIME.......K.......iTXtComment.....Created with GIMPd.e.....IDATx..\]s..q=.w.X. .....HP..!...$[.E%N9Uq.TT.G._...r..*.%.m.L.d."EI.H.D.....H,vg......H..l..U[....3}.O.>.w..........~d..E..0.`=....eY...B.Z.e.B..................3..>..EQl....M3......z......w7w_T.y3[.0....\.p.?/...P|..49.4...f........[.E...:......y..FOi.(.......EU...#...8...&'..l~....x..Q3..`..l.0L.8/x..o.Y.......|.G.{.D.M..y.o.8.p.?G........>w..`XD..[r.7.}...U]..n...{z...h..1.A.M..OD..^W.......6.t...?.....=+"...6.\U.J_.J.e9.B..p......I.._..NU7.x..7..u..... 3..:..{..AU.MC....Ob ......l..l...q.h..z..;!..$.y....I.c..#<....w.U.i...y....8...~.s.....x..*".U..'|.n.D$..z..s..:...H{..2.}.^..<8....%w..zEd.............$.>............w.@......MD..=..G...L...$..S...... ...(-R..1p.@DD.}DD.2.Aw_.B8Fj....Z_..+"rTD.......]E...*.Z..!w....>.B...)......D..X.f.0.W...b.2...v......>r.......S7......,"....L..Y..w....'.H.m...

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\hamburger.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 49 x 49, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):240
                                                                                                                                                                                                                      Entropy (8bit):6.393418700587928
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPfG+aWdKcnAI/CBlo3WumGhgqtmgTck/IjUVp:6v/7aaZpCBljujhP4kV7
                                                                                                                                                                                                                      MD5:4F76DABD56693B941D6A8119C1ADC2C3
                                                                                                                                                                                                                      SHA1:22F77B79A7AA5F110E231B78DF04EB3C2EEB70E9
                                                                                                                                                                                                                      SHA-256:5A10D64A13D8F86AF568F42C3A8017D3CC7D1EF8619BFD97B5E26D172DF21294
                                                                                                                                                                                                                      SHA-512:44D810B84C2E20850AF877870B08B1E550DCFBAE3F58259C86FC1E86E3AC23D494A895F26CADBCD060AE3E772EC2479F46D68D344A3FABDD1B81EB7D1704542B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...1...1.....s.A.....pHYs..........o.d....tEXtSoftware.www.inkscape.org..<....}IDATh......0.......ZS,".Nd^.. .dfsG../.Aa..Hru.XUsn....9.Aa....FP.Aa.E%..G..x.`0....#..=b....#(..0....#(...$g..U..(..0....m...Fj.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\hd.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2223
                                                                                                                                                                                                                      Entropy (8bit):7.740472932124116
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:JaIFLkqMHmq9q9q99q9qzu88l4Tb4g7vZZcfUCAIxxnsEq4pkI40x9Oalat3ezQB:NhMGq9q9q99q9qzu88lKvTc8ClmH0x9k
                                                                                                                                                                                                                      MD5:731AAE63A66214ED1268629B506B7068
                                                                                                                                                                                                                      SHA1:2C395C457408811CC4675B9A726E29F6D1F03C01
                                                                                                                                                                                                                      SHA-256:A43B3AA5015F0FCA47F578BAE4E9AD8E9E40CFCC3296E2F2CA2A297185F5126F
                                                                                                                                                                                                                      SHA-512:A753C82A8BD4E3E79E2D980125857C177510A5DF4155768C3FCD99B04B8FB7136B38B9BF9F3A687CEBBA8BDCD05A4F3E7C75F66280C1135A053C793559A00FCC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............>a.....pHYs..........o.d....tEXtSoftware.www.inkscape.org..<....<IDATx..{..E.....K)(I.BA.G.. j.H.Z#"b...$.X.by...X.jJ.M......"&.A...i..ZB.....(r...Z....iK[..%..;.;.;{.......3..y.....~.".c.#.....`...8..q\....;@[Tu90...kE._=..i/...xu....L[...0..`...8..q\....q.......0..`...8..q\....q.......0..`...8..q\....q.......0..`...8..q\......X.~.0'q....C.=..l...]..0a.5q...`...E.>..w..q.......0..`...8..q\....q.......0..`...8..q\....q.......0..`.l..U.".\.u..p....f.I..!".r.\.p........}...1 ....L?..,..Y.9.!.....r.9l...x.*@.A`Y.3..gl'.7....l......^.........)@Y..<W...Tu...D.oc.S.....w.....r....8Sp.......px.].q\.g...!|.`......8Sp...c..x.`......`......g.Y.h...Tu.p.aQ.+G...p;.YD..j,..z,p'p....I"....P.#.+...>..?Td'.U`.....F...L...'.."w....X%"[..m....\.\....[Rt?.[`..#.yb<.AU..+.../.....;.7D.?M.M..X...8.I..n....v4.#.U=.pfZ..M.....Ed[.l/Pd\NX....<.|..ED...h.Tu....*9.h......3.w...F.....Um.>*"..Ou(.:..).(S.7..Ddw..3&''k...q.~....0.X:...099.u:...!../.P.,`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\hd_white.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2194
                                                                                                                                                                                                                      Entropy (8bit):7.747910511101916
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:JlHPEFq9q9q9Tq9qOroRkJGp7EEOCJManZ64s/AqSbfezjv0J9/h2jslI1BDK:zQq9q9q9Tq9qNqGpExAManNs/NqfePcn
                                                                                                                                                                                                                      MD5:7C9CD2F1C58CF0C259F5EABCDAA9F692
                                                                                                                                                                                                                      SHA1:143A06BF5A9A04119F3D2B7CFFF406AE8A39F180
                                                                                                                                                                                                                      SHA-256:4EAF310920B4266B69081321D520DEF286824797516DB081DB09CD847C302E3A
                                                                                                                                                                                                                      SHA-512:9C15A86E42A0BC2474CE8183F4C887E438EEE5786BD6EA970023E699741AF6D684E0FAE54E22E856262CC010BFB74447A8FAD6741EC7D0AA4DC58DF9DEC441BC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............>a.....pHYs..........o.d....tEXtSoftware.www.inkscape.org..<.....IDATx..k..E.....ZP.R...C.....)5.D....Q.. .>*..U......`....`4..j...%.....D!.\"..b/.k.......gwgvgw..<.o=;;......w.E.p.r....aq.......0..`.iC.h....f..a...{..[1.....o......V.........0..`...8..q\....q.......0..`...8..q\....q.......0..`...8..q\....q.......0..`...8..q...._..H.."...^..6h......b.5q..S.......!C...........0..`...8..q\....q.......0..`...8..q\....q.......0..`...8....|..\.u..p.i....$.l..l9s..8..X...f*p..!"x..&.w...=9+.)@.`N?..`J..r.._......s.X..-..2......|..x..Y.f'..^..%pR.......x\D^(.6..:N.="....T....|.].!.}.\.C....\.Ct~i....x.`......`..........\.C...8.....p&...........@V.Z...U...',.y."..n...V.e@U....N...8FD.....z.a..Y.'.#F.l.........H.U..|...pB.n[....EdCr.-P.#...s.3..J...~...n....I..:.X.\..*r........6i7Y.b..J..&...o.D...(T. ./.R`f../.\!".rg{.".b..W6..I...M"..ED...S.U.......p..<...}P....sZV.......>...L.g..LU..,...;D........\..l.> "..Y..........=.r`Y.7..U=..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\info.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1771
                                                                                                                                                                                                                      Entropy (8bit):7.863050634593692
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:9laNhVnnXTRYSXZMtq6Z2KDUIg1el8brT:TQn6U6ZVRg7/
                                                                                                                                                                                                                      MD5:4DBA583BB7498C02B0C5F5CCAFD7CF4A
                                                                                                                                                                                                                      SHA1:52485A4DED1E0BAE4F91D9E589F91CF5085467B1
                                                                                                                                                                                                                      SHA-256:C7C8304731844C489538D77D2E1C8618E3140E868972532101CC0760987B6ECE
                                                                                                                                                                                                                      SHA-512:19FD7AD28C8B05A84DF459DAFD8BB5A117097044DAC266D05139338472B30C452574F098A854B7DDB3ADE8E87CD411CD4A546BE3F8D6D51B049CCD45ED22CCCF
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...2...2......?......sBIT....|.d.....pHYs...M...M..9`c....tEXtSoftware.www.inkscape.org..<....hIDATh..[lSG......=v..U..IPA.........]..-m......Vj...J..m.v....K[.&Um.E..$....$........v|9>.}H..1..>..h.o.93...o.sf.e.....o.j.4C .H!.....w.8...V.V..$.._........wz72........H.U.W.[.t8l..4....&....t&.J..$....> .y....^.RbwO....5f....2..G`..5>..".*.0..F8....z<....if.~x...!...B....L..`.#..k...Q..<.63.h,..+7..cQ")...x..y..6.......p9..J....5..=h.r;K.z......].G..z.W_....?o.soQB:...;l.S!.e../V..."\...7?.d(V...y........>.......n.nl...vk.].d:.....x<u. .:.........'..X...Zo...6MJ...E0L...l8...M...+.?..=..9x.Q.....VI..%.hX)...6.....:....+T...o.......x=.m.-....$....j^...n....>...W.X7e.%......%~...I...;...t..(Tg.P?~..&.r`..-.....d......E...........L.M...}._6o.5...>PmZ!b.C....;...=D.........LH.......N...jK...l.u9.$|.;.>........f.i..{{z;..s......._....+BF....?....<.V.z.9..\_..0....X..u,33O.....i*...9..g...L...x\...m..........W......_....M

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\jade.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3445
                                                                                                                                                                                                                      Entropy (8bit):7.919405513986357
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:qe2TP/jq76KuWoE5ymTkOkFpwWDGTBGiuzHq:q/698ERkffuRuzHq
                                                                                                                                                                                                                      MD5:EE4BA2B73A1F674EEA342CD51B17D354
                                                                                                                                                                                                                      SHA1:E381C0F26C9A8529B116F739EF8F845606DBA67A
                                                                                                                                                                                                                      SHA-256:FDFCFFCF836708F270DCD9C35CD1583D1712CCFE690B1BE0F368756FCF85AC57
                                                                                                                                                                                                                      SHA-512:2D47E248B8916B1C1CE1F6457ADD4A5A91FFAB50F234D17D929A64ADEA03D44CF509FAAA4472C68B3334555F3C1661260470256468C5ADB743676232DC2E59E7
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...P...P............pHYs...........~....'IDATx..\ml...~m.ml...zg.M..pM.&.i....JRR>SHU..P..L...Z.H.G.J...5I1..."..).B.|%.%*.X......;]..a....z.f...w;.{gR..V....g..yg....h..>.=..h..... .6.1.7w..c.h.....sq..LD.DtI....R.....{a.....r.t`.6":.#...r`<%..@.i.h%..'.V..TIfR...AD.$.&.8.{.....IR.t..#!..D\,@..`..E2.w....^.....y..M...F2.wL....J.E.......FG$...N.R.8..LB..#.G`.@....z:...I`....m...I.z..R........%...<....[og.K..4y.y.9n.eO..~o?y.zn^ujx3.e0.r.r....m.@..9K(.l.e..E}..p<.8?..U..x.....v.....OY..T..*."..O!.^...t..w....O....3u.........h..6.MTq.P.>.....m...E...mvWS........x...u..z;B...q%..;...Be..9 :=g.;F._Gy/.S.O[.H$.W......Z.^d.....m+3.I....../.q=.......u....g/.._..k.......@r....+.q1&......&P....=..r.....A..@.$.....Y...[\Bm.....)....=...S.p.=Qs.}..F..&P..l..cJ...W.m....'h.....Z.VG...&._J.............a3!a..BFZIQ.u............j..*...`U.....Y&.KL /I.T..PA.[k..=7.FID~A!M[UA.wVQy.Q.....s....[.;..}.(.`4uw...........x.$.2S.5C....Y....G.gj.A...

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\jade_unpaired.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3431
                                                                                                                                                                                                                      Entropy (8bit):7.921064358027522
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:uCdGGBsq+ea2IH/PhTHcOXNskoG+2/2bXE3pkb6Ep3DkTaGCS6w6ISJHazAObOu4:jsq/TmVHcCwskmRBDShiAWOMfENjkq
                                                                                                                                                                                                                      MD5:9531E35DE38675AD0E5F1BF4055D0E6D
                                                                                                                                                                                                                      SHA1:9C3F4EED41AF519D220FC626DF8C2F536EACABDD
                                                                                                                                                                                                                      SHA-256:AF909A3D42B8683A4E3680E6A517F832ADCAFE8A4CD835EBCA01DF3B7F3B43FD
                                                                                                                                                                                                                      SHA-512:C00159AEBF8DADD4A46CE7A89786F9DF827F40A997C0A5B737B0DC7A06A605BB0D2165C78BCF8ADB277521ADE8D0CA0E7FE97644551A72EACB2D6E894BB0D636
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...P...P............pHYs...........~.....IDATx..\mlS..~I.......)I(.f.Y2`..V>.`......I.....i*Z.*QR.45......`.P`...`|uM$&` .A..B.-..E......ss..k.s.C.<.........=wX__...:....!.mb.@..".&......w...""..x!.)W......W(....".^....$.......2LD........O.)!.K.z"ZIDyI.. .*U..T.9qo..kI..1.....L2/...]n.(H. .....2...............#B.q.t.........@.u..x.....B'....t.....=.......H...&.....I.wu...!>o...|...1.T.~(.E.e..? .x.........:M^Zv.e..H.eS...S....u..7.....*+'*...a.&.D..YBY.s)..<...q.../......l....m.......<T...{....&F....@^oG+.....#k.<.*....m.......l<.....{..?l...........k..v.CF`G.I......moa.g./....=..U.....5j.:.}.G..o.#..]u..wV(.o6{.i..3.w...$.+.Q..@...:j..n..4..sf/.......|...{...si...m\......7....CA.z....@...R!.9...H..t^k.p..\...P.AcB. ..6.p...>j9RKcj....[..^..*...VsLI w..-.0c.D...?.P..c@Z...T:..y...>.y.$........{..i%EE...B7..............VU.l(.e.....m..........}.z.D....U.taW....pn.{..h.......r..........."2V.m...L.......g.....5...}.......

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\kangaroo.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 452 x 452, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):15433
                                                                                                                                                                                                                      Entropy (8bit):7.920012489860019
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:KbbzWewCmX4GFOHLtdVWIgj00ANXmDg0HYicAgAw:KbHqCYhOH5HR0pumR4mw
                                                                                                                                                                                                                      MD5:BD9ED008918AD8DBC4A83E5E080CB38D
                                                                                                                                                                                                                      SHA1:CF452561E68CC1B439C75E32505AAD26E3F466E4
                                                                                                                                                                                                                      SHA-256:B9F0C0F86F9BD33D5058F13E1A24E5F25F197889EFD705B23212B2D53ED5043B
                                                                                                                                                                                                                      SHA-512:77D1A83C55BA1F03A4A749E9859116007F4C982F048C48334A90F733EB8F0AD2219909C4661A529021D94EC73BE29BFC788720DE8670ABD116F9E3C44326A844
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............._Z.....bKGD............ .IDATx...y.\U.7..snUo.^b...WTD..4........ ....:.....3.:...;:...@.N..v..8#.(...tw.d....}.?:..........1...u...........................................................................................................Q.47...j....:.."......s+.~."...........f....<...z..q]....HD4.mW.o4.........!S"."..o....a.H.!......3.|...P\...r.D..DDch..n..w..U.k..b .......^....8.u-Tz..HD4.}W.{5|...a.` ....ok.2.iW..u-d..L...h...B@.b..Z......N..M..7.]......c........^...n.3\.Bn..HDeo....4Ap7..e.=D"*k.W.....@..Z.-....l=p#.i.;...u-..{.DT....*...h`....R.j...:.uPt0...........\.A..@$...~.U....@..Z(Zx....J!..e./w].E.{.DT6.]U...nH.` .QY.u...x.F.@$..P).......x....o.uo..[\.A...".%Z.R.....q].E.{.D.h..u...\.uP...HD..vE...>.....".%.1.1.w...0..(..]5.%...u....D"J&....\.A..@$...e....u../.D"J......F..7..%.+.....uP.0..(QR&x'x.&..HD...jg..Y.0..(1z{.Z..\.A...(1..^].1....w.|E~YK.......-.%B....C.g.*....|.s.........0.......~..w...

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\keepkey.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2766
                                                                                                                                                                                                                      Entropy (8bit):7.892837039684091
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:9Bs/6U0323aiGMu3+RTfkxly0PwOorPlrO1C9d4PI5A1awAy1xXKwt:jsSU032VGM3qi0PsrNOB1awAyX6w
                                                                                                                                                                                                                      MD5:1EBB938309C368D0601121FAB8F0F2D0
                                                                                                                                                                                                                      SHA1:681E7EC01839FB1A554B7C99773051D8AAC81422
                                                                                                                                                                                                                      SHA-256:138658406FBB5631E86F232914D3682ECC389AB38153C344C98A4104EE8032A6
                                                                                                                                                                                                                      SHA-512:14502CD433D15B80DA4E6D988CB7EF961B862AEC22A3F8BB0F7A0358ED956DEB6A14B802D937C585909B2332ACBD39304597F57029E60B5C1F96B23B41ADE83E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...P...P............bKGD.3.7.E8P?#....pHYs.................tIME........v.....[IDATx..{PT....}..^uq.Q|..kC.>f....4.hR..?jTZcQ.h... ....b...c../2i......G.&"F..hD%...8.B.v.>.......{.ww....3.....v?......;..RJ.6.f.#........fR.....QV..w..r466..... .n..O.....X.h.""".-@......9.....{..n{&..........ZKK.S`Rx2...>._y.....0@..9....x..6.......0@/.2h.mL..........z..u.Q.....0@.t#..v\......a.L@T..$....t8....f..o]..C.B.....AcC.._.....(c#........p....A.c.[......q...DDF...h....n.i....a.u5g..q.=.........m......{..A... .....4>.ty ...%........oamA0,g4...9.;..c......0......DE....H(}......ee.!...;#F..+W.p.D&a(C.......ihkkc{~.qqq.7..].G...{...26nD..6.]..AX......f.M....g...$.M...Q.s...9...../........T......}..z......oa...^{..x..X[.....<.......?..coxg|..}.....l..@...W._..{...`..0.q.. ....3v..i..}u@.....L.y7;9Po.....3g.!vd. ..x.6.7.7[..n....=....'..<}B..&....c.hjl.h...x.....O..%@Vi...~.......=...".q(|..S~0e.4.|.. ....;.p..,.............C.dd...)....

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\keepkey_unpaired.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2726
                                                                                                                                                                                                                      Entropy (8bit):7.885679156988498
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:9Bs/6NrqJ08tTnmYp4/yfJljkrHg5ALnjH/+iPVDY/dzZQIIEDtQtUII0G8261e:jsSILpnV7jkraALj2itD4dFtIStMpG8K
                                                                                                                                                                                                                      MD5:35A93B6F9C34D75D8E8E5FFA73722C57
                                                                                                                                                                                                                      SHA1:21AF5562A93503AC670BD8CDB2771DA2B8AA80E2
                                                                                                                                                                                                                      SHA-256:21E768B2394316BB4D8EBAC274A6E95F3AF87D8B39B5E76EB6CF9377B875F042
                                                                                                                                                                                                                      SHA-512:AB698CD02BA077076416B55D8D9678B0C138B3EBFAD31A52FD69DB734C236BC36110F9E79490164D427BF07BEE94E5AF87789E7AB3B545E21AD3D80D90F3908D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...P...P............bKGD.3.7.E8P?#....pHYs.................tIME......("......3IDATx..]kPT..~..gw.......p.6.Llf.-.3.:#6M..G.JbRT4.A.. N4.Q.Z,I.....t2.4...F.aJT.p....! {9..e..|....9....|g..~......J).i..3!0.4.4....=q..]....7...z........ @b.8L.:..Y..;o.bccG,.D-..........g...{2.Il)....s.K.....`R.dv..M...>...&.R..J...$.y...l.{.......&.....].]8s..`.xZ............?.y..... ..2..*.'.....v.L.....G}.R..5....*...6.:y..n.Rr#..c#]H...ra._.E...[...III8y.4b...-.7.....SS.R..#p...I.'.x.".P.D.N...l^....1=P..6=/...r....!..2....../xPs..#AS...0.sT..M... .*3..p...Sf...M........7n.Bm-@....1....C.@".0.!m.l....by......nbb...@..Qh...aw..A.U...P..8*~.0L.X.F...^.]...V6M.!....o.....b.<._..}....1.j...@.._.s..V.|.S(.sF..q..R_....@y......{..G|..}...\.l......N.:.7.mc.*..}R.$$.K...........*......cc~>.....h.GNIO....al..aX...mkm...CoOo.Y...?WT.....i.."...>.^.....Zcl.X.SQ.........H?....a...'.4@..l(.S9&.t.cPL..a.(.".lr.|mmxU.........y5......(....

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\key.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5428
                                                                                                                                                                                                                      Entropy (8bit):7.949392842023817
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:xSIK8dZ37PTa2Axpa8wqVfx/3oYBdIM9TGBFAW/CG3FFfsqctJecttHMK9:xSH8T7u2ALDtBisTWFRH1F6tJBN9
                                                                                                                                                                                                                      MD5:8B6004564A09C5CBC57FE5E7ABCD7B56
                                                                                                                                                                                                                      SHA1:59B3ADEFE7ED3EFA5484AEC360F658A38FB8EDD5
                                                                                                                                                                                                                      SHA-256:6683C3D397403B789F4E3F13CCC065A0A863830F7393EDED843DFE6075971A49
                                                                                                                                                                                                                      SHA-512:FEE2C164C7FB28EB29931EA24A19072F4BAD031CC5665CE18B173C336ECE922AB99CC2B1B6072690EC9499BDBD2BA28D60AFBFB738965F1F2613BC6FCE24A69C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...@...@......iq.....bKGD..............pHYs.................tIME.....;..0.....IDATx..y|......33;......9.Z..)I.B+..j.?.Ykkk.b...^.z...V.jmk...."Z.Z.*.........;@.M...f........Zm..>..f2.d.s|..G....eL...J16..t.b4..5M:-.{.......ZTe.T..k..G.,U.P9..BrsW........0...s.a..../Q.."mM4..IC].u..}.......W.2._!..p.....d'.L..<.}c&.G}..{'.@*......X.||y.H_......sO..i...,*.j..q..GJ...\...........Ee.i..4.]....i....L.Rd......~.(.6...e..<...I...1o..$Sl...@.G!A..............q.:..._.e5....?P.W"1L..(TF.\.V..xD...D[2hl...N..Q..y......6.U...C@e.hM.q.Yq.I.f.a.....\C.e.//a.h..Q..B)..z...r4Ze.q..v4Zk.Q...\.....s.P..>......5<.a.e.F...a.._;...w..2];X..30.0..)&.P.].r....h.v...h......0......H....E..z...g.[;.Z1...X...p.....S'..q.;"..u._.1S.2`..7.:.^9.`..+....].K...{g.'..24...B..}...H.M.p8..=.....Woa.L...j.G.....[:..{.=.".Y.G..q.......Z]..9 ...r.0p..)xea3..l$. po.Q.5".k?P.n..p.8..".VD.....R2r"uo..........{...k..c..6WU.c......FL..d..v].r.:.^y1.Y?..b...,...:.[.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\ledger.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2161
                                                                                                                                                                                                                      Entropy (8bit):7.877690949768299
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:Ldqsv/ehL2tSwGi7iMVTg4c0Tl7N6ByL7LLNGxwTNQbOt0wR:5qsv/eFXwGi93l7hXLNGxwTNRN
                                                                                                                                                                                                                      MD5:1FE78953D56C84B4A21DA0E92D9DD6DA
                                                                                                                                                                                                                      SHA1:1F7284B2B71574D7EA07AC14F826D1E929C99621
                                                                                                                                                                                                                      SHA-256:BCED40406BB5BAFF13541CEB9FD03BBFDC485F3C0A14D39B5E56A1ADC021CC0B
                                                                                                                                                                                                                      SHA-512:AFFD2D9009D92287D0E7BFD0D69670324218FC089F9486251F6A767D481FF1F8267A5D9C75803CE8215EB89DD71A60FDB9D7C40D3D74D0DC689E9C4EEE3BF8BE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...P...P............sRGB........+IDATx..ylTE........i+...=h.......A......R....A.9..(BI.....QH.(F...F..(.h...T.@. . h....}Kwy.o.......k.o.o....7o...ioo...3..E......N.....+./.ztW.Z.)<......U............K...C...[U*...Y4...W..n......V....".w..9sm.2.......+.x...Wx.&.....0..D.......s..Y...bO|.{$.7........bj.!......_C.Z}$3...JL.....z..R.=..R.....!U..".=0.{.yJ..@..n'.ex...qJbE.(Z..{...?.W[...Pr....1.{.u..F..QX..gj.......p...9/..f.`!p.l).........]..f.J....0u.$.e......9n6.^.J..BC.Cr.h.....76....R|V?, Sj.7j. o.v.z.=:0...n7.....O...c`..wa..HI...D...I...P.../w.x..H?.[o/........'......~..V.n...a.[....!w.f..$A..` ..O<.......M.$..r-...).K...`.o.._....r.RI....qZ..L...I.q.,+..m.].....`..{....R........b. .m.......)......F.....nX.m21A.."..W(p.|vr.+..gm.C..F.(......r....H.Fu.....{..f..n./..I.....A....c...9q..x&@y.sw.VA...........2@..wH...U...<.C2@nd...<.Uw.P.(HMI.QO....a..Oh....*....w.........X.~~.0{.4.9c*...0.K{{.A..A.V..)........;g.,..............V@|

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\ledger_unpaired.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2140
                                                                                                                                                                                                                      Entropy (8bit):7.87248854648818
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:Uu3Yfl72SkZGC20QjtVnna2KRjFhk6MAPV8s6UFh0RodtItz3B+JNnsyDOX:Uu3I72SkZ80+n0jMAuoYoCLB+DnsyDOX
                                                                                                                                                                                                                      MD5:EC32A5395384BC89A92475046B5FBCDD
                                                                                                                                                                                                                      SHA1:9B82B1F91E51C41AFAEC4605AF7B8551C5E9FBB4
                                                                                                                                                                                                                      SHA-256:7AF9A6D6AE06198992E41CAD67DA0BA7A754AB8FA7309E7816DDE96C9F04BCFF
                                                                                                                                                                                                                      SHA-512:1D3569BEF25216654BC7505327AAC3FB484275600639A9A9477BB4B200ECC71EB90FDB85AC98F9D3E3AAFC931C0EBE0E6636BDF50F3EAFE372A170E5E07FB962
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...P...P............sRGB.........IDATx..yl.U.....-.(.H[E.B...H............x..Q....CQB@c4....#....9...!wQ...)..............v..vhw._.:...{........Heee.....l..f.u.k..E.A......$I.q..y...F$.p.P....z..M.....$...%.....X....^...........1q.q.|. ..j.=X.....f.....Vx.&.....jl.@dp..V"s..`...jX.k.H~n.E..-..V#.e...FI`- ..../P..o.",x>:...:F....""...O.?..F.....K<......n9...`..a.f..8X.......y.U#..s.1......c.. 0..6.<KG.>..iy# .n...a.........i......$].q.jjTS%...4.<h`.2.-XB....2.."....$.#...=...../.`<..?,....-.R..Z...:s&6.......N.~O..eee.....]:.B.v.<.t....Izc..........t../..#..b..#I.L....4s.B.{.28&.+*+i..{.....[.f\..sS.....C....b..C.........<uZ...k.`.B.k./.S~.O.a..KJN.+...z.&...._..C..z.&.....W,V2.i.0.X...i.....0J......).2..._..z.#.0.g..o.z6Y.V..._c...FI ...Z..$.ev....(<..=w.......z.....w../....cN.V..6.u........(.L.....!...#Sg...y..,..........K.J.9.....S..).'......WTT...(.|........F..B#......B....Dj.:......b...3.cF..IE....-...C{.?w:e

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\lightning.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 72 x 72, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):446
                                                                                                                                                                                                                      Entropy (8bit):7.0861494853353495
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7TaeVxOaw1fQxEeW+k8C10a/AhiaOF3Jy7:9e/Y1fQ/W+a/Ah5v7
                                                                                                                                                                                                                      MD5:78140684F45698CAE3761FB62AE349B6
                                                                                                                                                                                                                      SHA1:9088299D1BC1ACCD8157FDFB2E4375D8AED05C0F
                                                                                                                                                                                                                      SHA-256:954E52C6F49987DAF74AD9341C55874ADA731DEF069DD938842F170022AA2FC8
                                                                                                                                                                                                                      SHA-512:C7CE40962A051F0CFAE9AA38355201AA4A34FFBE0B65E8CE0464D4015F2AF35A068E99BEFBBD68C947407CD38A93178B63FDAD029A135A43E3091A61AAA9AB0A
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...H...H.....b3Cu...0PLTEGpL..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3H..%....tRNS...`.0. .@..p.~......IDATx..K.. ..l .&i}....y.w....hF....9".q.3>.....d....rz....LH...*-$.sq.M.4.....K...!..2-n.*W."4..B.....Rv..\..F5B<...ra....)..:"..Q.B......e..t.Y..Q.'....Q]..Fu....k6...F..}$W...,x,...C.......k.+....{.Y.i.bLHW..n...iLH..rq...;..JW(.r...*.R.&.QeB.U&.\T..CC..p.K4.B..v..%....c4.B..*.);.(.D...K..\>T_........IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\lightning_disconnected.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 72 x 72, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4825
                                                                                                                                                                                                                      Entropy (8bit):7.953699430939302
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:FPNGemd9jas1Vgkr+pc+kAVw5mOmq4/YfbtWb4wiKhAWvtSM4BEMZwGO8k:vSDjasQpp6AeRgobtWbUKhdvtSd2MBOr
                                                                                                                                                                                                                      MD5:7F5BF4119481B97CE967C64DB76BE223
                                                                                                                                                                                                                      SHA1:345C19ED37AC3D699CDF463A2048BDF9B2FCAB28
                                                                                                                                                                                                                      SHA-256:B3139500B7DB13D25D1B9CFC29D5A1964934610C11250928658ABA4F16449D2F
                                                                                                                                                                                                                      SHA-512:3DCDEC46C77A36446BA913A939F138BCC186113F55BD5C91FAED98EE52A2163A4E8E259C04363D840CB85DE39E1EA08038D4E16AE268086B7AF6617CD108E90D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...H...H.......{.....zTXtRaw profile type exif..x..iv$......>... ...=.....fI#iz..U-ev.$.%".r.?.>._.HJ.I.ZZ)..i.b.......{...^.|..\J..._..;.._/..3>_w.u'..@.}...lf;_...z|..y...sRZ....@...5...ay..u..(^Z..R.;........v.~..........I.5.............og....8?.......#N.y#./...4...............9.....u)x..2.:;.......Z..f..~....|.....Z.x.. a..N..8..D.;*..gL.ZM.[.D.h.'.....*..q.....m.w.v.2..<....^.......|.9.\.|}..vE.k..._." ....>.....c.*<fn.,....1r.+..s...)..t...E.1&$".KH9..5F..?V..<R............4.hs..l.D..6.....T.P'X"..Q..P.)K.d...{IEJ..h1..T4kQ.M{MUj..j....bK``n.i.....L....|..#..y....6.$}..<..Yg.}..0...UW[}..A.-;.u..v?..IGN>......WT......W..=..Q.S}."..d.......Z.H.h1.5.D....HQ..b.V...B.!...c.W.~)n.._.[.Y....9G....oDm........>Q}..X........">......j.7[d]G..|1.......^E.l..o%|K..>....g..}V..z.....9.xe..kZ\.U......N.]]k...v.(<.....V..][..m......P].m..Rg..J..*...c.L...^'..K...=.....;....g.....2G<{..$.!'.9..N*.. ;v;...=T...V...Chb..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\link.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 450 x 450, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):23125
                                                                                                                                                                                                                      Entropy (8bit):7.913567993722842
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:xBKjOrHWERCVV85p5iKzimD9MX+sbAwhYGAEP0ILW6DpcKDVq497mqysBPSEkqjy:x58Q5p5iZmmnbAqYGZJZDF9iulLG
                                                                                                                                                                                                                      MD5:95CF2F586590A039AD6A410B52F51D94
                                                                                                                                                                                                                      SHA1:F5ECD7EAC202F50BBD779BF2848037C1C3997D75
                                                                                                                                                                                                                      SHA-256:F9DB3A8E50FCB3A75C9E9DD5BAF45940DC97B7A3297FB0453CE3380CAE86C583
                                                                                                                                                                                                                      SHA-512:FA6E0E2508988B56F9BA9C81690CDE1D9B8960EC86B6F7B9A43A533F7A04B79E0D57A58974D210F614F0DAA352F849286F2254336D2D35E66D5FA413C25EAADA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............K.9w....PLTELiqb.C@..9..^.??..R./i.F\.;9..7..`.@=..7..:..g.Hd.Eg.HP.-7..9..e.FJ.'M.+Y.8L.):..g.Hf.HN.+@..L.)\.=J.&X.7[.:8..E. E.!a.A_.?h.I:..>..f.G^.>Y.9g.HT.2T.2J.'`.@b.B[.9].=^.=`.@...6..N.,O.-D. P..X.7].=E.!\.<V.5W.6M.+Q./^.>_.?C..?..9..Y.8U.4F."=..@..T.3[.;>..<..R.0>..`.@I.&J.'B..L.*:..S.2@..Z.9G.#=..Z.:K.(S.1H.%d.E8..A..e.F<..Y.9G.$A..c.DZ.:R.17..L.)a.Ab.C\.<6..[.;K.)f.GA..[.:?..;..].=H.$I.&;..H.%X.8Y.9;..a.BW.7F.#B..b.BM.*B..Q.0:..T.2^.?T.3V.5J.'g.H_.@?..U.47..S.2J.(`.A8..E."G.$`.AK.(^.>X.89..R.1c.CC..a.BF.#L.)h.IN.+8..V.6Q.0:..\.;P./C..@..7..b.CW.6U.3I.%D..<..d.Dc.D_.@M.*O.,e.E].>d.EP./f.HO..D.!6..>.....O..e.GE."9..E.!............|..........k}.d.....W.7............y.`s.Xk.N..v........m.Q....a.Ba.C..qf.Is.WU.4X.8Q.0\.<\.<e.H^.?S.2N.,V.6q.UZ.:M.+\.<.~.....9tRNS."".N5.....4O.c.c......ds.......q.................a.B...V.IDATx..}{L.g..v.:............d..c....B@n.......p=@. . .. ..H.h...zWl.mZ...cg..v.;S..v.i......;...C6|.}....

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\lock.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):40380
                                                                                                                                                                                                                      Entropy (8bit):7.964394337432647
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:+ab4sv7U2pM2a7u6BurXDFEcaaZk0hLxr+G/uClVkAHChcfJoBfZ6m:+ak84qM2QF4rXDFsaxLxrt4AHChchoBv
                                                                                                                                                                                                                      MD5:34DC98521BCD82497EA0ABDA704CC73B
                                                                                                                                                                                                                      SHA1:81DBD99712040045E5CE3CB5FB36E8E7DFAA720D
                                                                                                                                                                                                                      SHA-256:91012C141285680812ADCD9EEDC663A38C1296FEE3709EA700F48F55F5400493
                                                                                                                                                                                                                      SHA-512:0FEFDD6685928FD2C72E5427FDA0DD65C3AE1AAA40B6232C7A20420F225E778AAA60D7ABF24793DD16759ECAB0CA9597BE10F4A057A2636A8A275DCDFD0FB867
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............}......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.........B(.x....IDATx..y.5YY..{V......#...(W.A..b...nQos...1.....AI.."...... t+.....{..D.Z..n...~...{...?.V.Z5.]{..O.}..}?...U.^.z...A..]...x......;....+.e.G.ZV....#...W......5..GD.........'.ufZ.x...+.u..:..5":..../...{e_.A8.P........J..PO!....7.|.......\..z.....y...8O...:GJ?...G..<...\(...........7...\.u.kY...<...0.)....{.......p.f..D_.>...7..r...Ye.V...#.....o....,0....b.Y.]]v...g.|.L.%.>..}7...._....e.L..:"......^\.......z..o.p..r.(..|......Z._..o|..B..^C.X8......B.V..]..'.|=...O.<A.....+......WVVt...2.......++.z.....O..>..QB9\$.k.G.W>|.w.*.@..........]_..!0...|#.Uv.....}..)1...o..O...](A.6"...m..m.W|.A..`.. .........?.......J.....4..I.....j....A&z)..C....)&..f....).0.0I...f._..|5y.3.........n..w..u?.X.....".,..+++.f...2..............].....t.).*".....V....K.x-.];...>.LwW...-]f.......y.;.zS..u.....e.G.l...X..w..Ke.F.. .,.Y.l...

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\lock.svg

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):12125
                                                                                                                                                                                                                      Entropy (8bit):5.044141834443952
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:m6Jekp81JeM5I+sUwu7IStmwNvyWMd67Of4mKm+jZLKYx6:m6MkCX9Cr7u75tVNvPOfTR+4E6
                                                                                                                                                                                                                      MD5:DF4B5D8065ED9636F912AC1FBEAC3884
                                                                                                                                                                                                                      SHA1:98A87B2D66CA68592DA2E21DF2BC12029FA19342
                                                                                                                                                                                                                      SHA-256:DAF51089C0614450482A65DE2A5CDE0303B07C3A3DAE87BF011466A91ED4140A
                                                                                                                                                                                                                      SHA-512:02ED73FC39B111672A92B87C4E8CFE86A2E9DC826451A4C3BB043A5E2777F6EA8079CDF887FE27900184DA97C620E349FB2ACE3C0293A8E307977E3DAEDB382A
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8" standalone="no"?>. Created with Inkscape (http://www.inkscape.org/) -->..<svg. xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". xmlns:xlink="http://www.w3.org/1999/xlink". version="1.0". width="512". height="512". viewBox="0 0 22 22". id="svg2">. <defs. id="defs4">. <linearGradient. id="linearGradient2411">. <stop. id="stop2413". style="stop-color:#fee7b1;stop-opacity:1". offset="0" />. <stop. id="stop2419". style="stop-color:#ebd4b4;stop-opacity:1". offset="0.25796592" />. <stop. id="stop2421". style="stop-color:#c8a775;stop-opacity:1". offset="0.50796592" />. <stop. id="stop2423". style="stop-color:#b0935b;stop-opacity:1". offset="0.74009573" />. <stop. id="stop2415". style="stop-color:#fcebbf;stop-opacity:1". offset="1" />. </linearGradient>

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\mail_icon.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 65 x 54, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4548
                                                                                                                                                                                                                      Entropy (8bit):7.940902601053362
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:B6MC1mfxQGFRS5VXbT/yeTEd0YaUnPj0WZqbvYm5WkK/cm:BaomgRSfbTdQdnNPjCLN5WD//
                                                                                                                                                                                                                      MD5:AA97731F75066BCEDDE8077F4AD87430
                                                                                                                                                                                                                      SHA1:7340910D7E74C2FFDB1830358EE7BBA823057CBC
                                                                                                                                                                                                                      SHA-256:D603B32D4C331092FE947B1D2E9AD43E7D701436B539DFADA6FFD85838DF8699
                                                                                                                                                                                                                      SHA-512:77E793266A6F947C9C37C1BC278F03A63627D3B1E93D5025F1964858AB6D132DAC33E054B75E1210096DEBC29620546448722B9FEC46DBCB003E3A7386E5451C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...A...6........<...AiCCPICC Profile..H...wTS....7..." %..z. .;H..Q.I.P...&vD.F..)VdT..G."cE....b....P..QDE..k..5....Y.....g.}..P....tX..4.X....\..........X...ff.G.D....=...H.....d..,.P&s...."7C$...E.6<~&....S...2.....)2.12....."..l...+...&..Y...4...P.%...\.%.g.|.e.TI....(....L.0.._..&.l.2E.........9.r...9h..x.g...Ib...i...f..S.b1+..M.xL.....0...o.E.%Ym.h.....Y..h.....~S.=.z.U.&..A..Y.l./....$Z.....U..m.@..O. .........l^....'....ls..k.+.7...o..9.....V;..?.#I.3eE..KD......d......9i...,......UQ....h..<.X..d.......6'..~.k.hu_.}.9P.I..o=.C#.$n?z.}.[.1...h...s.2z.....\.n.LA"S....dr%.,...l.....t..4..0.,`...3p.. ...H.....H.i@..A>...A1..v.jp..z..N.6p.\.W..p...G@...K0..i......A......B...Z.yCAP8...C....@..&..*...CP=.#t...]..... 4...}.....a......;..G...Dx.......J..>........,._..@....FX...DB.X$..!k."...E.......H.q.....a......Y..bVa.bJ0.c.VL..6f.3....b..X'.?v.6...-.V`.`[.....a.;.......p~..\2n5...........&.x.*.....s.b|!.........'..Z.k..!. $l$T

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\menu_vertical.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):997
                                                                                                                                                                                                                      Entropy (8bit):7.21865102763374
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/76q22Ox4+s32iWfG4yCDFRbRkUWoFulndZf+awOPvY2D0Vfk2IZv0Ake2Z7nx:V/Bs3wG43FP+Df+awO5D0VspZv0Ao7J7
                                                                                                                                                                                                                      MD5:52379D1219B147DAD4EAB4DD3916BE89
                                                                                                                                                                                                                      SHA1:068B1EAC1A6484C2C25D026917B94D4120E14565
                                                                                                                                                                                                                      SHA-256:E6ECB30EE42657FF6449AE801B32599DE79BBAFC4227A6F1E6CEEAD690A1D672
                                                                                                                                                                                                                      SHA-512:C6B96A9E9BD69DA68F89E4EA04785D2FEE574D278C120B0CEF1134E5E039B3CFAFB5DBA4354126817BACD45E6A776222775D0A70AF26B84FE97257B1040D2DBA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............R.l.....bKGD..............IDATx...AN*K....#.....2.G..6#..u...a..........PE../.i.*..4....................`...,..&.&.....^.ao8I].U.......,.,8.]......w=E.8!......P.d..U.W....J2/p.I.......$....$..r......K..M.Y..0..$.*f_T.....r..p...h...4..i.@....).MS....4M.h...4..i.@....).MS.....m*f.V.....b.{..IP......+fC..cQ.....Z.|......WX....9...K?..C_...?'k.....M._...m........................,..&.f.`...b..NR.d..;.......dtI.Sn8.S....J..[.EN.{....y..M..H..&.B.,.u.\..-....R.|.vV..L.&......'A......;..o....4M.h...4..i.@....).MS....4M.h...4..i.@....).x.....'A......^1{..`.u......X.....)_.."'..t.......$.EN....+<...W.'....'.K?.j..~3.u........................$.$.I..?.k;......%Y%..qG#..,8.]......%...R....C....5. c^.|../..I2..;Kr]!.~yK...n..8.......I.b.E..IP..~*...G....).MS....4M.h...4..i.@....).MS....4M.h...4..i.0.b.g..IP..>*f.W....o]1..b6$.;....`.e.......].q....:.y..........:......s..I.....d....{..;?.................0a..5...k.......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\menu_vertical_white.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5565
                                                                                                                                                                                                                      Entropy (8bit):5.489309030569267
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:5uURgCETmGA0Ok0IBEoPlat2DybcSwnLVpe3wLKpe3wLKpV:5uURgo0Ok+yIGy4Sw5gAGgAG/
                                                                                                                                                                                                                      MD5:A9F45868EA789C17608B8AA7CFD0195F
                                                                                                                                                                                                                      SHA1:D2F573015718D8A10C3C29E7041BF8215D312D34
                                                                                                                                                                                                                      SHA-256:A492B9E638F5D68D304854B2D683B9B587427CFFDCCABAEB27EDAE7C4058760D
                                                                                                                                                                                                                      SHA-512:E573D2FBE7848286DF6D959481164E94C4FE33EFCB2AAE0199B5579F883C1BB1105DD2D7F13C2F61BCD2D555927367E64B3E0CB97F5521EE008D32196E16E1A3
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............R.l.....zTXtRaw profile type exif..x..Q..(.E.Y.,......`...f.s..O'...3_.*..,.E..I..._3..D.K.j^j).R..rC.3.U.W.R....dOw..$..|.r.....8...~..K.../}....(........A.@;.....u..q...?..E.g.....7....!$.J.?..x8IC.P. .(.(J.....wq.S.G3\.o.=Q.[..^ie...K..]..'.....3g.Z.l79.....x..>.....B].E=..Z..c......fx...rEv..0..w.N...&e..h..N..f>....e.].+w.~92M6....]`...Z...5.c.A...1.}..~..9.(.m~..~1G..F....@...T].~...\..5..G."..).+.{...-....3H6....S+.....j$J.6c6".....u..;..*.8.Y...sL.......s....H...9...X9+..e..j*.U...k.V...+q)6......Uk..]...{.V...M..Z.Zkk..A.....Z.y.=.....{.[...k/.....!...(..:.A....=.a...h.[mJ.y.,..:.M...-...].x...vS...!Aq.h0.0N.@...64...)g.r.l..S..'5...b ..b..`..$.....d....Wr)....wn...Ne..S.A....c.;..]..N...i....}.>B....G........_.?e.. bJ?....iCCPICC profile..x.}.=H.@.._SKE+"v.q.P.,..8J..`...Zu0....4$)...k........... ......"%./).......=...B..T.k.P5.H.cb6.*._.D/...(1SO..3.._.........9......H<.t.". ..t...aV...s.q..H..u..7.E....62.y.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\microphone.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):199
                                                                                                                                                                                                                      Entropy (8bit):6.502673009329309
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPO6xshxyT1I3JQilfevL5xFVs9Q2lbp:6v/7Pxsh4a2FvLG1
                                                                                                                                                                                                                      MD5:1986AFF717AF895B8B22B8E83A8DCD8E
                                                                                                                                                                                                                      SHA1:1B085C4ACADDC63D6098DBAA2F10831F7275FA8B
                                                                                                                                                                                                                      SHA-256:EF6C6AA285EB18667D992D916DCCF2337FBB98B07631DE8EFBCBEDC24958E347
                                                                                                                                                                                                                      SHA-512:F5DF9E8616932B0F879046BBB2A8FA4E534EDC77E59D3A2B1058DA73C36AB20E126FCEC073034CC64414DD129D554B64FCA403E6F49096E29B63EFF015D3B3BE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...............7.....IDATx...i.A.... !5.... .......Cc....N.....@E..=&....O...AVU. .M.d.....*...@.T......n.....n...x.|zw.7~...f...jk.l.!..O...k..\.h.).<...%.._&....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\network.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3031
                                                                                                                                                                                                                      Entropy (8bit):7.892998440069336
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:UNpK7kK53XJ2tvzTuqKyRmuY5yQ8QdgLPclW5yUQobw3Ha+qpJ6jInqd4JihEEs:CkFpWvzCJuYk7QiDclWuVHapojthxs
                                                                                                                                                                                                                      MD5:56802ED77DED3282C7E1133403AD809B
                                                                                                                                                                                                                      SHA1:211F85B6B9476DE56709B542E2C8715BF2F3C16E
                                                                                                                                                                                                                      SHA-256:42D7060EA7B16E9CF8FEFEF098A56A77616E595BADDB5DCD353242A1C07CEEEA
                                                                                                                                                                                                                      SHA-512:FE10A020FD519501CF7EE9B7C7E36DDFFBDD1407B07D6AFB44D048AB3D30662BDE1884F248CB13983CE0D55622FC561431F9825DB1C03605E0663273EBE12036
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...0...0.....W.......sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<.....tEXtTitle.Computer...v....tEXtAuthor.Lapo Calamandrei..*....IDATh..kl..u....;..R$E.T..zP..n.$.%Q..Z@..q.......N..ua....}.h.~(....>.....N....T4..t[.p".1..RRG.dZ..Dr..3..~..KR........;;;{..<~...*......./`....-*..H.@....]>..@.{EC ...Cq.*....4..o..{....x..H....?q......0...w..c."..A.D.b..j......-...}<...|N.=>/..k..U.^....F>.\..F.aJU..j.n..........y..c..?M.jV.B.0A......B.8.s....w....<(..srf.U....P.H...gY..|..I....+#@.0...3..H.8..ZG..*..,42...X....P..E.....$)!\..1.a.l..h....i...<.r...3T.r.H..b.A!...%... .2.f....Y...%....kq"5&......Mr.....L...t)..F_....H.........}.6r...0FQ.Q.Y.....k.4(ij....c.l..|PE...0..F....h...".....}}QY.r|....<..9"..j.,..J{.Q..E..8...V.A,d.21q.......P.....%..Z.../.3kx.1..RN......|.......k.....8.l..x./<.K.i..J...F...W.,W.(...8.PT.V..).5...@.j4%.#....@...T.... .B...J...9 r.h.^I\.....%..*"...4...q...W........D...T.fDM...!?C.U.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\offline_tx.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):463
                                                                                                                                                                                                                      Entropy (8bit):6.995233320421183
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7kYiUpZhKeAAthzDyVmlmLVOqm2UKx34nRP7aW/GFQHN:UiUpqeAEZDyU8ROBz838P75dN
                                                                                                                                                                                                                      MD5:51FB191EA358A072A69F92E4D5278D54
                                                                                                                                                                                                                      SHA1:2A782A97B00C2BC64669AFE9FF45F0DCDB9B11B9
                                                                                                                                                                                                                      SHA-256:81727605617F1CDF8A77D48BC554A080555730969CA261CB669560D295B4D65A
                                                                                                                                                                                                                      SHA-512:B5BF8270536BBCDACD6C89C54ABFA88D0307FD4787638A06625AACF9F6E09A3F0A45F466F2F2062D0F15BA04132E4847A5C1FDF0AE36484802FA85DA76D078EA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...0...0.....W.......sBIT....|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....LIDATh.c`...`d.Ft......a.....f..0...Z..\...d..`.m..C...10..4+.De.R....fR....|...J/h$.E8....X.o..<'.........F..@..<0.`4..4.....F..@.Q..4...@.!....(..W'..`......IIHK.6C..N.....u.=...P..v.6F....|......I1....AX...........r.E.$.02.C..2.B..4...u.!4x+...#...x....zr...?.C.es6....<p.*C...E<.bd`....@...c)$C.b.Ud.,i......`......2.L^...f....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\paste.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1309
                                                                                                                                                                                                                      Entropy (8bit):7.792147582960006
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:ygJEdhS85SSGg6Ay9BNVQLVt/6tw2YoZ5leNGR1+x1BOTlcti8imX4tQGIIgx4aL:hJCt53GJ1GLn/6tmoZ5leNGR14ulZhmX
                                                                                                                                                                                                                      MD5:04BD3B83FFC3260171E9A6116DB5CB8E
                                                                                                                                                                                                                      SHA1:EADA3DA9D6BA77A991A4BC14D8079C315C655F21
                                                                                                                                                                                                                      SHA-256:64A811C29845A9B15BD87D8C1751ED55D075548F5F62852BF21602248DD8EF8A
                                                                                                                                                                                                                      SHA-512:A1C24D6D3918A1F215271239880AE1D220E7DD69A5C75648BA711D2CE82707AD07AAB9F0C2F34F68CA46E46E7644115C7E4CA248165AABC009590C2F30B1F8C8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...0...0.....W......oiCCPicc..(.u.;K.A..?.E.A.-D,.P.0...Rca.D...f..$B....Dl.....h...h+.*..".X..|5..;.. q...qf.e....y....`yNr2../,j./..B3..t.....;>.S.6.z....hI...uM.#..x.c.5.V.-.a......#...Rz*.g....;......Z..SUl.p.pO!_4~.n.jZs3R.dv.d.8.)....#*..j.b?.)V.c..f.G.Yr....(]M...M......f....qhx...^h.r....|.|..G..*.U.i.C.RE.9..&.]V....oA.;......d............~.9....y.k..>..Y....h....Q....pHYs................TIDATh..Y;o.A....m..%...H..d..h...H....."$*J(....D....D.@TP .!B(...B...'...|9.w...rWxg......=.e......y)%...+...S...-@.b.}...l..@.q.......q~.N...@..@.I.b.D....hs3.KQ1c;fbDrcc...C..?..$........Z...p.....['..z...JB\#.&..A_.5....oa.U......*..e...,..iuu.U*5%.`j.....MN.I.t..o.s....0{S......Jr..c.K.c.~..J.c....v.. ...=X.......H..`l>M1.3vX6...2j0..j..r.8~.S.6.w..6...8.[lt........90.P.9....|.6....E=.....@.<..C..x7m...h6wY....P}.6ph./.i..L../...|(;.{.|.P.......9Z......c.N...m..E.^..t..o...l!...8@)D$pT.\H.;.@.v..;.....Er...id.B...U.~h.Uh..g...C.z.b...C

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\pen.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 127 x 128, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5625
                                                                                                                                                                                                                      Entropy (8bit):7.863385035645726
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:ftQcpmstcPvvR0gTRowipcQJGWoCxQJOQJHVLPZoonkswWHc9:FftcXmkFoG2VexPm5swUy
                                                                                                                                                                                                                      MD5:239AB6E6F6A28BBCB05D713E045BD0AE
                                                                                                                                                                                                                      SHA1:44D5F007F7EF15F5A7394E893BED9A69920CAB1C
                                                                                                                                                                                                                      SHA-256:67F080F04A2248CE33741987DCB836AA5B99FFF9F93CCFB2F1A7DB54DE45DB31
                                                                                                                                                                                                                      SHA-512:BB9FF9BEF96D3FEF1746AAB73F9AD48612E1523CFCE805135A146E5CBEFA45386A3F1ADDCFFD5ABD83B5A1630A596F572D5DBDB5628CF327A5F759142932ED1C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR............."y......gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....bKGD..............pHYs.........O4....IDATx..it\.y..........,.@H[l..S..$e.B.r.!ml..h.n......R.....$.9m..&m.f9.4.I...v...<.l#..I#/.f}..+....W3......;.......W....1MP..Y...n.n.V.W.M..$.1`.8....9pB..S...<.....QK..&.g~5...}..4p.............../.$.<...?O.~....a..J...g.{...a./;...|....,P._d.M..R."7._B..@..b.x.xP)5h...=.n....f.M....|..:...?.F`=p....P..M]].D..X._$.u..........X.l......'.Z.c.lo../.2...-.T....@....qS6/.nV..!........u..V.i........W.Ge`.}>...h..i......".."..S#\..,".....Y....._...4.R.....<.n..B.X....K.p.;...MM4....A2.b<.......$22.X,..#l.-;....O.92c%...@.5M.@.8......a.*.b..[Z..F.k..$...H......i'...-.`.?.....3@=..@..I........r..u|`.jZ......>.`aS..Z..EMM.2.H......F*...0"7\V....R..I..8.......Y.pa^.......,...V.E.L.......V.U..#.;:..P.?.m....o)............q@.gIK.[...tz..7....H.......c(..<h..T.c.(.~?+\.......q,.e<......x.8..w....zB!....N.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\picture_in_picture.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1519
                                                                                                                                                                                                                      Entropy (8bit):7.346859617844218
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:Vv8FhMrsQe5h9j9GjW2FT/0FEPOcahAAAAAsnAAAAAAAngWFvIRYmmUlkBOXc4J:OFhMa5h9j9oPt0FEPOcuwgAFmDkBKc+
                                                                                                                                                                                                                      MD5:A237060CE839D930C5BC4C31B929F5E4
                                                                                                                                                                                                                      SHA1:5F999A8B7E54E606D9F12DA7D9BC3210EF1B299E
                                                                                                                                                                                                                      SHA-256:7B28A4E860A10C693B44D9B7E12E8A45DF7F21139945308D04291CF12C4030E6
                                                                                                                                                                                                                      SHA-512:4A1EF9180C35422A7AFC1AD24215D6ED1F35D0602C97E4AC5677167F4D8F4B465D5A5E75CB7CEB4AB5A505679FE90077B88D5286F2DA271685F2987A367D603B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............R.l.....bKGD..............IDATx....k.u.....{.......B.."..0.J...h.F.d7....A.B.C..u.T.iPH.r...)....MH,.......9..r..........9.......}7................W/......[.F++e..d.j.<....8`*...A....Oy....Ff.ZW....}~.il..6K.W.'<..F$...;.cM;W.n...i...._/.l..E..3..4.I..zu.......N...._...Hj...@1N...[.z.....-.U_..S...(..5V-m].a.<:..G|^...[RwC..../.7<...L>...>:.m-#.O%.*d.P.ojmy.v...3.....:RyO.....]......}.(....v.....(............>.udi)+......v...{I.Q....T*..'?.}s.J/..0I.{b.N.......V..,m>..;@M...@J.m.$......&.....HK...V;..x.V..L.@.%@...wf&.H=.HdE&yG..@.v[&..3.4|A&~.F\.3M....$..Gh........Dr..OgN.S..<.qyC_......?........it.|........B#..F....... 4.@h........B#..F....... 4.@h........B#..F....... 4.@h........B#..F....... 4.@h........B#..F....... 4.@h........B#..F....... 4.@h........B.S..d..whl..z...@.n.in....o.... 4.@h........B#..F....... 4.@h........B#..F....... 4.@h........B#..F....... 4.@h........B#..F....... 4.@h........B#..F....... 4.@h........B#.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\preferences.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):58005
                                                                                                                                                                                                                      Entropy (8bit):7.981001133922237
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:+PxrzHqcm39TBsFQNUX7TYIUh3lD5mIuh8/f9kH:+Ph2cm39dQQNUYIUB9BVFo
                                                                                                                                                                                                                      MD5:0BDE10EBD19F36D720C2AC4CB23C75BE
                                                                                                                                                                                                                      SHA1:F8D92A3FFC02D6B655021E7366E1E4343CD2E4ED
                                                                                                                                                                                                                      SHA-256:D3D4163A8D6788F78D2C2AC56E261FE506F4915065EC488F79F858C7CA13C2EB
                                                                                                                                                                                                                      SHA-512:844CF68A308B5A3A755714249D7E1A4F65264114EB2BD5BBBE8C190393E25E799A39982BB1F1EE1CBD2F7D1E351F16E6A2088AB2F6387D17FF3BFD8CB974C120
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............}......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.........B(.x....IDATx...w.....NUu.I..(K......P........w.w...z.B.wg..!.k_s7\.]{.7|..i..A..l.ec0A(..&..X.............k...NUuuO..y.s.......`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`0.....`..2.'..-O>.d$.J%.!M.....$)..@$..}...N.92.....x..|%&..*.....R..`).e...h......+.......tS.>..>..c..!*...|....~....1.a..Cv...@.....=..w........t...8@...%.....;v.....`0.3.&.:...S.F.K.O..b+......+.@.....@...........c:..<Et>....n.p..M.....|r...'.....~C..S}B...1.`..D:;;..X.&..;Aq3..T.S.8......a..v.v.O..`0..L....]..R".9.;0."]..B)..|L....u.M..0..F...<...

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\preferences.svg

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):27175
                                                                                                                                                                                                                      Entropy (8bit):4.978296915866158
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:MxltEaE11Es9O5cuzJxb2GRbz5nKbTqggjNRnx6Vhr9SC4cudg:Mxlt69CX7bDdz5nKbOgsHxu9SC4vdg
                                                                                                                                                                                                                      MD5:5AE87DA02D4994C81EBED270CD45405E
                                                                                                                                                                                                                      SHA1:47BBB94DE7DB651BEF731D915336254ECEAE9085
                                                                                                                                                                                                                      SHA-256:8310F15BB417931A99FEA8EC0ABA6437C422A007BBDDE088ACEFF605718AA854
                                                                                                                                                                                                                      SHA-512:A0B849E22842F931F0C4998B36F353951264857927BB17DC894991AF88BB05271DE623F75E054481BEDE80048DBC21EB224AE7951319D40E313192FD7B9CF755
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8" standalone="no"?>. Created with Inkscape (http://www.inkscape.org/) -->.<svg. xmlns:ns="http://creativecommons.org/ns#". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cc="http://web.resource.org/cc/". xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#". xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". xmlns:xlink="http://www.w3.org/1999/xlink". xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd". xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape". width="512px". height="512px". id="svg4289". sodipodi:version="0.32". inkscape:version="0.45". sodipodi:docbase="https://commons.wikimedia.org/wiki/File:Gnome-preferences-system.svg". sodipodi:docname="preferences-system.svg". inkscape:output_extension="org.inkscape.output.svg.inkscape".. viewBox="0 0 48 48">. <defs. id="defs4291">. <linearGradient. inkscape:collect="always". id="linearGr

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\qrcode.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):314
                                                                                                                                                                                                                      Entropy (8bit):6.8331753934323185
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPVjnDsp5BAAAl0hy2YxsDEIyFtKgcOsxq0j9/Iov5Fgo4G8up:6v/72RAAANmDlyXKSsxqigyngo4o
                                                                                                                                                                                                                      MD5:5B142F2315C1878A0A13E5B0112CF477
                                                                                                                                                                                                                      SHA1:44FF82A1B89C623EF19F4CE6DC51BA5916F8953C
                                                                                                                                                                                                                      SHA-256:874D11BE3C20F635845464AD2E4FD1866D1CCFA3793E51C6BB0466433409A75D
                                                                                                                                                                                                                      SHA-512:593793B1ADB885C025FFB5D675B9B290C961D6F542E87BDCEF3A6E7B28372D45E55A63A081281FE4477E6F180F3758ACE67D1BEE0F5300B563351B8DBFF50FA9
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...?.%...@t#.k.....,l..... .@x..F.."..g....7..............a..X..$.O.,.q..P......vC12{7T#3.8&...}H4>.>4...hQ...B16>....Q,..b{$..P1.....'.l>I$..DV(}........h4..Fs.m<l.. ..... ~.%.@b.Hr...@..JE.@.....@.. ....;.".......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\qrcode_white.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):380
                                                                                                                                                                                                                      Entropy (8bit):7.010361133917859
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPv19s/6Tp0jt2jsNcgzwHunoxxrBd9AYQOYuBSE8lGEUHZo8l/jp:6v/7js/6Tp0jmPgcZJd9pQOTBildsH
                                                                                                                                                                                                                      MD5:80AE0CB6EC943BBD3ABFF1EB25DF4AFF
                                                                                                                                                                                                                      SHA1:1BE471FECA3CF83842034E07F419FBD8A62EFB8C
                                                                                                                                                                                                                      SHA-256:BF6ED6E043082EFAD7B047B7743FC554DE765BE504E2F949F326AE1418C40706
                                                                                                                                                                                                                      SHA-512:F9768E970731B736AB9BBFCB912E0D692DAA95939C26E416B2B754B2D9A375ACF8DAD7472A22FA723E9CC3E6E24AF1AE21392F1FCA8FCC608812B374D025F686
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR................a....bKGD..............pHYs.................tIME.....6..}L.....IDAT8.S1N.A....It.i....HA.DC..x..?..D EBJ."M:*...4c..".JV VZ.m.k.."..9ff....<;H.Jzly:.$.afp.'3C.Ug....d..@.s........H......,i..H..u/....%...W.5....<....o.{<......W.:.+...u...9...&9O.c.........i*U.Y...m..%y.......u...1"..."b..!".fvZ}.G...;........,.._$....K.O....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\question.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2555
                                                                                                                                                                                                                      Entropy (8bit):7.903707300768179
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:SGVuz+yQjPAlzgOkNeRYpi5Utb3deYhwQBySsRfC36iVMCekiFfeq9p46HuP+q2:RTyQzvOkQ+rtkBQBySlqiVPe+q9oe
                                                                                                                                                                                                                      MD5:AA64EE12B7213AA1FAF0177F513248A7
                                                                                                                                                                                                                      SHA1:560838B563379CEDBFEEDB38A8B234E67CB9D0A6
                                                                                                                                                                                                                      SHA-256:7131F304F5152243660964A0B97912E13264E8B2E8BECBABF58ECE964F6D06CE
                                                                                                                                                                                                                      SHA-512:515E66DB60166BE9A4883C2AD734F5EE1DE187A1A2087FFB03D9D0E619012E289B4C91B27B90C889E976D20502C6CDB85C10EC889EA63532790356E6CBF0DA17
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...2...2......?.....piCCPicc..(.u..K.@..m..t.A.!C..V..8j...)..U..B..K..W... ..k.?.UpU..E.qs.."%.k.-.py......w.?.3..I....l*)....;|.C.SH...2.4...#US<.E..u.c........2.;....-...G<.Jr...8...BW<~.\..K0.e....)..XicV...$q..+.y.q..j.,S..5..Y......lB..8e.f..h..P&....*89.(.7Fj....5.U.tT......f...$....@p...\...u.g@...6[.2.i..ZK.......)....0.l.\nH.Z~M.>..p......Y5.q......#`..#....h.c.......pHYs...M...M..9`c...1IDAThC.Zkl.U.>wf...n..].Ph.)Ry.Pjb0Z...|.S...6Q.....$...?CH...)H...@).6..PyH.....v..3.z.....mwg...Rv..{.9.|..s.`..YH.[._..Qi...DBj.......F.(.^..(.s..j.{..7...C.k(..D.^..[&.Dq9...+.n.Z.."..Fd....|.P...Z)e. .w(.?.....x..(c@.#[[.oGK>AC..NGxYY..p...r.@..\..%..)...........T'...m...@...T.@Z.w...|...+/.5...|4.x.~.;.<....H..L~...O_.Dg.@....bwd.'.._\.V.V-....2Yk.k.. \.y722..)....{...s.2.xAZ@.;p..n%.....W..,-.OG..k.....?...e......gF.S6/..?.\a...nwvi.*.#.6....{ ....$./8$........K.@^8|n%2..|w....(..bd.Jd..........~...?.)....T&........H..:/].2.."

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\revealer.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):272
                                                                                                                                                                                                                      Entropy (8bit):6.2770460901246015
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPgNQV9Bm4dKcXtrX4C6MaAJoSYMHrSkPtWGiKp:6v/742LZZX4CnKMHtPtfj
                                                                                                                                                                                                                      MD5:EB80AEDF5B34DA55D8374BD64C31388A
                                                                                                                                                                                                                      SHA1:657C580521EDA2F1950AE2759CB282E802A5726E
                                                                                                                                                                                                                      SHA-256:F71D617A02018D8C805A7E60FD297CA1C133D83C95FD52FBD557DE4BEB337297
                                                                                                                                                                                                                      SHA-512:313B215288B72B9E75F71B0F21BCA4C64611DAF2AB7E8C1B42E3C36FFDA78981C5D88695285DB4CBD4304E2720947DBBFAD001E2BEBA7392774D238E846CC1DC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...<...<.....:..r....sBIT....|.d.....pHYs......... ..|....tEXtSoftware.www.inkscape.org..<.....IDATh.....0.....5.l..1..V.5l.....}.<r.]j.[...7.....5....3..`:....3..`:..j.....\Y.1.....3..`:....3..`:......i...U.{.].`:....3..`:....3..`...b.8.. K....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\revealer_c.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 510 x 510, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1965
                                                                                                                                                                                                                      Entropy (8bit):4.837695335858453
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7PtPyHAxS7jTGECKFOFOtnFOF7FOFOtnFOF7FOFOFAFOFNe4FOFOFAFOFNe4d:KyHAxwvGMeee0MGSqeeeGZtaeeeCa
                                                                                                                                                                                                                      MD5:6546779DBC25E0DFB2F935BF96BC5024
                                                                                                                                                                                                                      SHA1:C0CC2CEAB6FC52683A7460C365D0B5E42B24AE03
                                                                                                                                                                                                                      SHA-256:E5402C2963B446F93E667631C3777CEE9CA14EB60D8943C83EFC6707DBAD73BB
                                                                                                                                                                                                                      SHA-512:33D7BE6D78BCE54FA6454E6DAC33A6B1ADA26E29D299BF159EA3064D8405AA6B6BF9E4483BE1AC95E0E6798E51216A9E1653561DA546BC31B0A1C0F0836E5F9A
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............}ol%....bKGD..............pHYs.........B(.x....tIME.....-.#.b....:IDATx...m.P.......A........#.....;/....RP..oFp$K.s8g....t.......7..........?. ..........?. ..........?..?. ..........?. ..........?. .............?. ..........?. ..........?..?. ..........?. ..........?. .............?. ..........?. ..........?. .. ..........?. ..........?. .............?. ..........?. ..........?. .. ..........?. ..........?. .............?. ..........?...j...a.RD..&Z.VF.Y....j.&]..C.D..9.N'C........~.@..........~.@..........~.@..@..........~.@..........~.@.............~.@..........~.@..........~.@..@..........~.@..........~.@.............~.@..........~.@..........~.@.............~.@..........~.@..........~..~.@..........~.@..........~.@.............~.@..........~.@..........~..~.@..........~.@..........~.@.......7...?. .....&....H}...p..1..Q....3....n.[j......w#,@e..........?. ..........?. ..........?. .. ..........?. ..........?. .............?. ..........?. .........

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\rocket.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3869
                                                                                                                                                                                                                      Entropy (8bit):7.9449346827433525
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:+aPMsUHEPMD+P2oaKky+FAVNoFwA9ZZ8kOF+2wZGifY4egixgAkJcNQ0tqkX0:Gske75uyMiAXZiFMzfYgirnNQeq+0
                                                                                                                                                                                                                      MD5:E23FA5FEBCA81A2F9D4C131F7E9F5120
                                                                                                                                                                                                                      SHA1:7F4C2A9604A5A3E800E7757DB91178B8FC6ECFE8
                                                                                                                                                                                                                      SHA-256:F8EE64F59312C356D1EEB4164F746646398FD5F8555DD30A9A3744725C136891
                                                                                                                                                                                                                      SHA-512:1EDA81A435CC2BF4AD358B27A50B4CFA241FBAD7F307792B34E64491FB26464FD015EE672201F2B58A590501F789F403BD4152367D20F60AD083DF65C0FAFD93
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...@...@......iq.....pHYs...........2.....tEXtSoftware.www.inkscape.org..<.....IDATx..y...u.?...;..."......QRA.Qh..jLj.4..JQ.hc.U5iWC....f....&..Wl..:.T...C..E...".S|...M..\.p.7#......g....}..g..PJ.........Kd..s...M.01.m.k......>.l...."..V..O.hm..Hvj........~D.s.`..|...'G....-....w..BQ.P.-.&..d....i.^ln....&d....Ig..........I.@R..s.....?..l.+b.........?m.8.{>.....$t..,.)...Q.H+..."...f+..n2.v.p2@[g...).6.....d.......q. ..T,..3C........)..........46A.ki......$!Y.(!..}..'..o7... B\^%..P."..!.).R.{.J:.F.+k.HP.:l..:g......l.{.&./...2M.E".......-.]I..UyBGQ..@.~?..I..m..[..X!.UKn...H.!j;y4d1.>./]Y.......@...*...lzg..h.@]P%..p0H(..WG.`...q=Xq...O....(.TI......'R*.eg.\..9`r.LJI<.A7.......l...........?!..W....c3..c..=.....S....x.`..2u:/.3.......7.]....7v4-E.W......A<.C....G:..-I.X$0k6._w=...K>.1..... $..V.,......0L.C3.B....q.<.@.J)2.,c.Qf.6.w4.i.W..n.|T..c.yJ.u.0>......R....5.L...(.....~....x.OG*K..d..=......k.P...>......B..E.R.vk...t.Q

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\safe-t.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3871
                                                                                                                                                                                                                      Entropy (8bit):7.925259657332706
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:rnh7N8ANZJlsMQmLrEiZyBnxhvQBC/GvoewBQ+afUF:rhRPhDA6LyDF
                                                                                                                                                                                                                      MD5:EB70FC4885507159B615F8D8F2DF5234
                                                                                                                                                                                                                      SHA1:63A3FED99DB4CE9AC40B2C49E1FC4A1084754686
                                                                                                                                                                                                                      SHA-256:F614054FC285C49271D6821040EA7612C5E604B7A4AC64C158B3B08BF202BABB
                                                                                                                                                                                                                      SHA-512:1620D2E147A7FE46ECE0A565605F2C0C10964BCE4652D4D97A1F1DF11BA69C210D72177FB9BC806C1F6AF49BB3BF2E44CD3A25AD451A41E8E6C1E7C02EFDBE59
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...P...P............sBIT....|.d...._zTXtRaw profile type APP1.....JO.K-.LV((.O..I.R..c...K.K.D......04006..F@.9T(......Y......1....H...:.C2...kIDATx..yTU..?...*.."..dr.A...c..C4..;.5).V....k.....}...4y.Q.D....C.h........ L..Q...+...~.\.p.>..;...u......_..g....#..H)..^m.@.......>-.-.....=...JgR..@.0.H.F..@......j.....%B.:...~.PJ...m.............q.D..f..X...R...@.0.{.J..{[..9.......Q!.eo+.H@)..`...L.....@....'..-.....M`.'.u....[.h...l %..V.D."@...@.)..^........+..$.X..In.(....Gw..c.Z)/+......,f3.5........V].C....Cll,.I.$..I.$...=m../..`X@).8...!.^.@II._..RZRJqq1g.q.m.1x.`F..MrJ.....=..hwz.[=............/*......J,f3...444..........O.$...ILH$}B:....;.......(....s.o..U+.....H5=..........<..dr,~Z..z...lG..|..r.?.x.6...oob......F.1*`...M.......*.....q.,((0.Gs..E,.....R..F..tu@[E.;.,.....n.'...%55.S......S..R..WQA.qqq..,......4..EE.Z..C""X...wN...n.X........gaA!........[..5r.g8.N.7<.t...p..... ........l..a.........5-.G/.X..y".F......%

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\safe-t_unpaired.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3719
                                                                                                                                                                                                                      Entropy (8bit):7.922465789444943
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:mbw1zNchE96p0vyZQG8ILP/fy51iRlEKT:sw1H0pVzz67iRSKT
                                                                                                                                                                                                                      MD5:83C26D946771AA895638259920FB2FCA
                                                                                                                                                                                                                      SHA1:D36154772AF449A2038AE412B08B42F8E8D3A20E
                                                                                                                                                                                                                      SHA-256:14ABF48D20B24205713A709BCC1946F2F94F3070320AD1D50848D06EB8F136B2
                                                                                                                                                                                                                      SHA-512:AFC2196C49438A131B7D797A94462E052B9B633A654EFBB1B54ED6AE179837B4F2D2A5A198E8695222D618E18C462505A1579D99D36E034488B1E1A0D2F694F3
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...P...P............sBIT....|.d...._zTXtRaw profile type APP1.....JO.K-.LV((.O..I.R..c...K.K.D......04006..F@.9T(......Y......1....H...:.C2....IDATx..{tU..?;7 TX.a.`..x$....$.....)..3.X.:...Cy.3.......5.*...V..|..........`.7DI.KH&.q..o.8........]..>.q.w.}....>.~..D..:?...P..vt...W..J)w..'.7+..a@&p3....R.....+P..).>.*.RM.i.=.&.....t~n.n.F...n.....g......-....r...x.^.......S..S+...a...`..H@.......`..|...O+...).o.E.>.@L .Z.I{{;.W...v.v.A.wG..*...... ..I.H"##....U.]...Z.o&........[I....TUVQ]]EMu5..:.N6...DGG._eE....HRR.i.i...K..t....m....4.2..PDn...mq...***....NT.....S_}.O....n`...ddf.......IHL.........0.....r.....Jjkjp..Q]UMKK....A.HNI!}L:.ii...........TJ].S.-.Ed2p..}.6.y../.)._.p8x....UO=....L~R)...r...|O..bV.b..x.n...onb...g.-..y..-.6.._....M...{`II..:.5g...ry..+"c...uAgA#..\..../.nd $.Nb..8"...\.?v...K].%%$''{..*_y}....EGKK.,.bbcy.g.}..v....X.....:.%N....<...F_y.........Ett4;v.4......[.C^....6N.v8.5..#.......k....Q........

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\save.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):946
                                                                                                                                                                                                                      Entropy (8bit):7.238902576094043
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7StqB047Xy5ee5y5ZKSt5mpDef6WSvZtzy+/oQGfoRAs93BAGyjlv8WcY3kz6:zqBpb2X5yz5yzzF/30oRAs9R7olvxcGF
                                                                                                                                                                                                                      MD5:524B4AE79599E80D26B065337966BEA7
                                                                                                                                                                                                                      SHA1:3D09102D8DD55404EAFD48EBBC36AFF16E40CD6F
                                                                                                                                                                                                                      SHA-256:91361F9D7BBA7B184E3F9500DAE1DB28771FB0A1B4EBF2B92A63268311A1D2FA
                                                                                                                                                                                                                      SHA-512:6A9C7CF5AD5C6D5550DB2B793A32A818240FC51207F07EDF717BBC9CE775DCFDB157EDC9D662E016280C2C4F015876ED4E38D460B6B7F6DE685394BE2D1C42DB
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............>a.....bKGD..............pHYs..D$..D$.@g.T....tIME.....0-I.....?IDATx...;O.a....E...lD........VV..++:..Qk.l..ha.((..RI01...a.....X0.j@f.7.s..F.........(...............".......%]c.%IW%."b....^...nI..;.q.vD......I.......#.....W.i~S$..5..wI..X..[.{.dw.N .Z....E.O.X.F3.pv7..wm........2..R.....>.....q...{.i&..W#b.?...".z...M..R.../........{..^..[e-r...s..JY....n...8+ ..-.!.T.=..E...@...~e{....ND..q( .z...+6..Sd.|.=I..5)i..Z|(P.g...........@. ............@..k..?....k.....?P....~gP....tE.^..,i{U..C.H6.*...H.&i.....~..."..{....o%m.l.{...:....U..->...@....................>.W..%]...VN...YM..........h....s.^E5.a..0.....%.S..r.....,0....-i.M...3.j........@. ............@. ............@. ............@. ........@..X.y.).l..l/....P....bW.m.:..{..^.....s,b....lwZ<.N..=9.b.!.Z.u....{....$i.e..!i...8v.R^....&$.rtO....Z..DD/.u....R...2.2..JZVS..[.uI.#b...................C....>0.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\script.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2911
                                                                                                                                                                                                                      Entropy (8bit):7.81621123142847
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:Jwv4jhZueRoLGg//fTyySWNbTLumO62ZZ3mykhWPGbaDNIcBBvGFmL20Fph:Q4jhbGGgXrywbpO62eFENIcPeFC2w
                                                                                                                                                                                                                      MD5:E4EB569930024777ADF71335659D9628
                                                                                                                                                                                                                      SHA1:0887FFF664052DBF5C249348C3F6B1C50B975D33
                                                                                                                                                                                                                      SHA-256:B1A056AF1AB081946509AA01247AF17188A83950B60FA7C60C6C1DAAE7F95FEC
                                                                                                                                                                                                                      SHA-512:9B770EB23EDAB751D64B861DFE604F279BA40D79661D20A93FFD14CB0DD02BF785FE3865E2EDF89D209FDADD83A6D5C85F75B6BB5285C3A08A5F09661927643E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............>a.....pHYs..........o.d....tEXtSoftware.www.inkscape.org..<.....IDATx..m..E....lBr;..P.T$...E..R..%..Z%x.%...=.p.."RV....J.j...6........K.P.BI).A..Q.).Q.!;w!...Y...7.;....q.3.L2......%..a.....K..@s...c...#....4...9F..1.h..@s...c...#....4...9F..1.h..@s...c...#....4...9F..1.h..@s...c...#....4...9F..1.h..@s.........f.*.....u..j.u.0...$.%Dt..8...=.w.!..l6....p*.MQ..=..s.(...`3....... ..1.....T*}......1.%..=.a....~/-&.m.z.......A.|..?+.N..|.......$I......*............0..y./0......~n..!.V.5..........$I.-.."^.E..<..&.m.A.6.o.....|.R.l..9ELI.l...y..E.0....P.?.p..U...=.......e....yr../.v...j.3..(..AD.V.\....g|..8./.......[.B.././......em.p.$f..q...,k.*..?.$.r.....|.m.Wg]73.....l....!78..%.z.".Je.eY...Q... .>.e....m.k..R...q......\.?@D.R.....j..Y..D.(.F.o,[..e.M./=...JDw(.#......E......'2.P.3..\.?.o..h4....L..b..w.......K.$...Dq...........^.+.<.8.......Y.!.MOOo.p..o.........O1....e93.\....F........j...q.g..EG..).I.l......

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\script_white.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2910
                                                                                                                                                                                                                      Entropy (8bit):7.78162310769412
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:Jddoic87FE78T0Vcv45kqsqYbzPSouIPH0xtychu23202ga3MXhnXGGGGGGGGGG1:TacqQ0ev45HWBxPH0xcq53/2N3WGGGGH
                                                                                                                                                                                                                      MD5:F4C51EA252273896904B5E517D45B6F4
                                                                                                                                                                                                                      SHA1:385D5C9AF9DDB7D41E679F9644852461B41DF088
                                                                                                                                                                                                                      SHA-256:81D7844BB8753850E1CDF997D5DF6EB042842DC56588495CF9837F73361059DD
                                                                                                                                                                                                                      SHA-512:5FB851442B88AD77A69E63DB4B89AE65860104022B0921D9D075C24DC74C31B0D2961750F5A569F6E49409CF8807F4D577C77CF6200D84C7BD0529F6ACF7CA4E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............>a.....pHYs..........o.d....tEXtSoftware.www.inkscape.org..<.....IDATx..m..E...o..BH.d7..._..(._.T...P......).0+&.AYg.....KH. ..G...1!p'~....-....._.5.B.v/(1$.;..~..*9...ef.K...<3.L2...t...V.^.......,o-6..c.`86..c.`86..c.`86..c.`86..c.`86..c.`86..c.`86..c.`86..c.`86..c.`86..c.`86..c.`86..c.`86..c.`86..c.`86..c.`86..3.]F.7n<iddd..K.....vyOu. X....'...u..vy... .C122...:...._JyQ;..:}}}.....y...`G.X.H.....r....7 "....S.!.M..C..R.../l....R..9.!....4..c.J.R..0L%m.h....{.h;.M...H.{.....R.?i... .<.....MsJ.::S.f....... X...b. .{....<..lN.{:.y.."r42......I.'..)e...4...We..J...t:...vi.B....6.O.;...Ap..m....y.u.....t&...........3....a..j.X...."......n.<..8=... 8..Z...9eI.\.-n...........#Jg.............h...(....B.sqz...r.....4....-.ut,G.8.SD.5.,... ...._,..R.d.[4.J.j....q..p.F>.....s..j9....g..w4.a!.R...[.1.L&.../4.9.T*.........R....z.DtS...]+....f..\..%.)..A..V}..@.......giN...8.m....;$....!.)w....[.h:.CCC=.t.?.d2....H..4..;.yw.X|{..7..).

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\seal.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):38276
                                                                                                                                                                                                                      Entropy (8bit):7.932151176253116
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:xAR8qtQJNd6ZMn8JykOulKvxZw3JF3bNYdGknf7XeXcwuREyd+ESU3BshYDs:xEHinjkd0ZI9RyzcyMU3qhp
                                                                                                                                                                                                                      MD5:52B3CA06916C9DFDB5982CC92DD2575D
                                                                                                                                                                                                                      SHA1:F69222CF35B62643991CE7E994F43AB223B7C21B
                                                                                                                                                                                                                      SHA-256:E01E904D8F0B7CFBCF645BE75A34658A96B3097C2051122F081ABF00CBD3B48A
                                                                                                                                                                                                                      SHA-512:D7C57F4F83E6AC0167F86E09A3F2E4FC8FA3DCD6D299508944B60D28F7F09B4A78A70CEC05C112E03EF9AF879702BE6F62711A23F0F5EBD3891438B4F2BB2998
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............x.....KIDATx.....U..SV...&.ww..u.........+........S...-3e.e7..X.<.......{....;<.,....,...K.K.M=0.@R....x.......^..<....<.......+...br.......xT...b.#)7...x.............../....<.Qp..q...I......x..^.g..7.....l......2o.|L.........x...B....z.s...o.?......x....?($I.............W..0.....{..p....w....k...}........](.$&.}>!.?.<...a......3}...c.+!...V.h..o..]..H..|.C...xq.......8...........x..)y<.:.'.....U./..}.......e.H_..p.I.?...x....s.*.H.\J...;#.....,.U6.........U.}*.X...eO<.........}.Y.Ll...2..?....Azj v...XD....vgg...x...cx..={~......3M..h.>.......n..w.z..rzSS..).....+.....}....h..7......~, .z.B...<n...ZoL.\.....+..n..o...K..........ju.E--_.....+L.....b...... ^. .p....<.q.'X..7..F.Q_cB...[UU3=.....{.....vu.};...}.._...bq...@OU<....q....~...G!ODzj.......H.....<.q.w..zM...i........j..;.O.fNC.F^.O3d.=.......{;.......G...p...u.?.....@.....8.._.......W*{eb..j4.....k.....FP..b.................0...0.A.M

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\seed.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):10322
                                                                                                                                                                                                                      Entropy (8bit):7.961641798240323
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:NXiG2KoPuBCiEtvo540UOYCgiaUMk+8qLrDXYDjyvluIn5g:NX724vUvoUOajUMprsCD5g
                                                                                                                                                                                                                      MD5:B49187017DA350C42910561B3929BDF4
                                                                                                                                                                                                                      SHA1:519ADF378A91AC0F05577492DD86A9E6D6863765
                                                                                                                                                                                                                      SHA-256:E7020A4EEC65ABFF62B0884B0BEA7102CB2AE4A1FB619231A2E4E8BB910F57AE
                                                                                                                                                                                                                      SHA-512:EFF1E0B3089EC88FA8A08087928C3315481238BA841DE69580FCD12368F60CC2FE2817C8171467367828CD02CFA8C6F7E6D6DCF7EB8635B453BFDC956724E8AA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............>a.....bKGD..............pHYs...H...H.F.k>....vpAg.........0.1...'{IDATx..y.]U..g...;.[uk....@&HBH@..S....n....El..t...OQ......C...M#"...q@Q.. ...$...*R.x...s..c... .JU..|.'.3..{...Z{m.mN'$I:...@}.'..UU.....O..(......Nw..B....".....K}..9.7...:.......,.D....a.l.P.B".z..".q.../....)..#.w|*.s P.{.w~..E.d...t...}.r.....u....Pn.B./C..o\xy...x....{....Sm..q.J.....A'.&W.N......e.B.z&...1.4.......v.)..1.$).e^0.*`!.@z..=....?v....We./.....N.;|...t..?.|..%.y....h.D,..H.L..L..........x..........f.9....P....K..~..I6U.....h.2.E.ab.L.9..1..s|~....e.B........k.o.=qd....... C...R=...@.C....p.....6.:0k..E.t. .-...3.D.%B....B..Y.h.6.}I.3..%.{.M......s6.8.U..(..-~...+.o....t..fzO.e..?.....dR.2)...bm..px.8..........C....vkD..4..Q..*.)rx...x..W?6.v2."F..s@......^.../+.r..^w..........+'N..9z .........&.<..o..>|k...zs7.....g....x....<.dC.X......V..H.{Kc.....z.x....{.{o....q ..H.......R..M..\....E[...r.....9s...,G....l<{x....

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\share.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3325
                                                                                                                                                                                                                      Entropy (8bit):7.887613741553613
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:oSu44NQ3mHvwJg/FhWLmNJdzL+2ZZqoCHOBY:oSuThHR/FUmNfPxZZpyb
                                                                                                                                                                                                                      MD5:B285C32910F8F429E718E8781862478A
                                                                                                                                                                                                                      SHA1:182CCD2CDBED505316EEB79B33D05B79AA032F1A
                                                                                                                                                                                                                      SHA-256:A8BC2EFF5BFD5A8863738A09727D8D62AFEF8C354BFA51E1D669CBE70F21A182
                                                                                                                                                                                                                      SHA-512:DBA28ACD787945E94DAE86A5ADE215993BF531D47CCB200C42F12FBE44CABAA1B7152B38F1B0415952D661BA3801680B551BFA5C1E9758948778565E1FFFE38A
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............>a.....bKGD..............pHYs.................tIME.....).P..m....IDATx..{X.U..g.n..~...."xI@......j...Y.<.c..].r.is...6}..L3/)x.T$.L@.......3\.f`ng.(wm..3...._..........;.<..D0,...g.y.4X...&.a.X8L.&....`.0...&....`.0...&....S.{l.....@G.' ...<.|`gm.....J.......l.A...D.V.<6.~............iQ..h.<....m....x.~2..1.L.+......OMx.WW.P..u .x#....&.....-~e.....1..[\..[O|D.9..l..!..a....9O>.L.....>...n.L.#..-....pw...1.|..:mC.......p.s........9..>.>......Af...._o...Cj....0......z?..E.w..L.....I..rlk+.,L|.U.C2!<.z..3......@.P..0..F.6....05.w....W...#..5x....A.a......O.../|].).@...4.X.}.Y..7...F.K.G..@......#L.}cg#0.X...2..0.X......H...F..D....9.CL...L...+....W.....;\.U......@.T.....q.S.20......PS....r....Su..j.....-.......I.O..Gc[.a.h...%H.&.T..@M..Y....-7..H...\..p.f?....&.FW|..8.Uk..u6b{.FNV..-+..&{........+.......@G.M..."I.;Wm......tN.bL..0H.W....W.Z......_...v....%H..l...:.W....e....rz....vq.*d.wv+.U. *.......|..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\speaker.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 16 x 14, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):392
                                                                                                                                                                                                                      Entropy (8bit):7.094128145339606
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/755vlvZUUBtLVLtpAHYqfr1YRozObbf/6gU:65vBCU5pDR0ebf/g
                                                                                                                                                                                                                      MD5:5E2F1E05870F10236CA49F7779146651
                                                                                                                                                                                                                      SHA1:53368F74DDE769486680C05737D699F4279716D1
                                                                                                                                                                                                                      SHA-256:E5E86CB035D56CCEBB94B895EC863C5B6C89001973962EF3A2D3FC9B14D740F0
                                                                                                                                                                                                                      SHA-512:004047CBC4DEE63974060AC8EC1F9C18D0F6187C2F2F6D17EC765F84F3CCF56CE6C1BB8C4927247A9725D11CCD3FD8D967FDFBEAD84AAE72EF2960D5206290F9
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............&/......sBIT....|.d.....pHYs...%...%...z.....tEXtSoftware.www.inkscape.org..<.....IDAT(....+.Q.....R..4...VIY.&+..........feca..-...)%%.U~...+.k.)3.2..Y.s...=OD...B...J....-*....p......<O;.\[}..Xji.!.`..Y;..F0..n.w.,RJ.)..+.#b%"..b..).FJ.7".8.F.:&........!g....T.|..,ED.a..Y..tQn.._.&2K.R...v.4...G..&.J........f.k..k.&Hu.h.R.Q^...G.E.....?..E..d....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\spinner.gif

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GIF image data, version 89a, 128 x 128
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):15209
                                                                                                                                                                                                                      Entropy (8bit):7.832309628792709
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:loXLumk5i9IIS1fi1ekpslFzcdEeE2dOo+gFRiAVJlR7klRHRsW9:ixH2f1dkSFzcqbMOozFzMxs0
                                                                                                                                                                                                                      MD5:6E58AD65334FEEB5E49BAC33334AB526
                                                                                                                                                                                                                      SHA1:AFE8B6F09FA004BDC88A0D649D857D8E6A6D76F2
                                                                                                                                                                                                                      SHA-256:CC4FB2AEBE634B741BF2616B811DD630E466A9A8930B9BBE10A281F9717DAC58
                                                                                                                                                                                                                      SHA-512:EE8EC86152675AB2D126BDA46ED63674BDDD31835F084333696361BAA2E7B7C281FB2E7966A75711A72908F87F96F9230A334630AF31F485EC4B935EB95070F6
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:GIF89a.......$&$......dbd...LJL...|~|464.........trt...,.,......TVT...ljl....<><.........,*,......dfd...TRT......<:<.........|z|...424......\Z\............................................................!..NETSCAPE2.0.....!.....-.,.............pH,...r.l:..T..\F....D....4-...g$ )Xo..sd.4.|^.:.2h..f...qp.o,tFvyxxzw......D.#n....D.w...y.'#..g%.....p.C....z.....M%*...B,....!...E.....u...w........su.z......*r.......$i..`^ ...).u..3w.E...`....jd..G...M.f.|.A%k.,..~.<" Q.I..(s.Z.+..3.>K5.T.H.Y)u......NW.(Z.'.I..i...LH.D`.:.....}...l?.d.....G...z\i.,.<...{.A.!s.\I....k....x.].5..IAI......M.E...(.[..:.M.L.:.k.D...K....3..U....i.=..w.....C.H..g.$ @.....N..<.....xG...u#..bH.\.....>/G....W.g..C.....A."@.......0...^U.^.. ..l .~.<8D...@.te..PqG.....NS...(...........o..."5.....-..."SI...I.X._.$h...M......a.#.%%....A.....I(!(c*.@e.NVD...)..].R..**...B.I......s.. .Q...(..DF.=.i...:L4.)..nJf.......&q..p(..Sj..Bql.D..".$..]..F.9....k.=......bp..O6;.q.*`..df...."

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\status_connected.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):71068
                                                                                                                                                                                                                      Entropy (8bit):7.98934726992817
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:IE3lTv6JiUQhPsNVAAgkcjoDRjbnT5Zk6zWfJzV2YrDQiPnHL:J3lz6MPUlgkjjbnNVz0Z22DlPHL
                                                                                                                                                                                                                      MD5:D0F584A62776ABB93DF85D8DA2D81843
                                                                                                                                                                                                                      SHA1:94A10ECE353ADBC2B530A4758FDED9CE885CE0D7
                                                                                                                                                                                                                      SHA-256:7AC930B1113B8A35B428909E2D6BB737C9DEE0CACAD5B1AACF4B36D48D1006C4
                                                                                                                                                                                                                      SHA-512:C2002DB69265DE5E4E9890EAA8978BDBD59763A8E9837A38FC4893066B3CFD95CF65C9BC39B105C19CA0DDF8D85F9F4EE9B9A8F59B05A06ADBC580B8B3BD5698
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............}......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.........B(.x....IDATx...w.,.y..."2....y...a...&AR4.4.h.......fd.v.h.YiGgf.f....G..%....I;..).h.$..h.6H....}.....GUVeF..,s...2#.."2+~...`F3....p..*.....;N.u.B.w.....>A..bF3.......{"...8...?'...0.........&-.ft..L.3.......V.....E`...w..3...f.<..%).Z.@)..7i.N.uc.N...0.hF}.....g".l.@.C....FC.C@..h..;....4.hft?....$..~.....`...wF3..i6...^%.......2...3.N....V..m....4....KT.}f..C.C@.>3.....5..L.z`[.P.L._..h.>.........gt........hF>.F.33W......g4..`..V0.rg...=.u.=@.&-.f$....h..b...&-.N4....c..xFSF3.....tg4j....f.<.IR.t....3....xF...7.q..P..*...3.,1.......p.hl4..f4.......,.jF.I!z |.Y6....f.<.QRdb.CO..i~...y,W...U.e.........X........u)a./..:8.b.D.F........0`........!#.....a.{...c........M..m.....5....6...)...#..xv>.FB3...(....[.}....?.3.%.l......:.;K.z.Pv.P,....5X.=...,..b>y...M.E.:...u.e\o....> ..B....\3*.f.<.........M.Q^.{..\....*....

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\status_connected.svg

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):6593
                                                                                                                                                                                                                      Entropy (8bit):5.024932699526309
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:VkoIanLDh/IOKDYmT/35VYfLD++haM0c8XBrTo8eaABra2BS865MBR:VkaInDroBgBrToJaABm2BS75MBR
                                                                                                                                                                                                                      MD5:1206186CDCF64DAAF9B40B26E438C5BC
                                                                                                                                                                                                                      SHA1:A1D4104DCA55EC6E496ADF582E9F56C4A936DE43
                                                                                                                                                                                                                      SHA-256:63CA3C36FF8AEF25630C57A2214BA8BFBD279C9631D050F296DC437D75BB2A5D
                                                                                                                                                                                                                      SHA-512:D31BF55DD7A454A864DA65BE01AF3B9F3CB37316D8D7D687BC6DC6B6EA5BF4723ABBFD31D7C9C7C0F29C0FA2157446D16EBC061CE7AB8DEB436CEE4FB42C6512
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<svg. xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cc="http://creativecommons.org/ns#". xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#". xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". xmlns:xlink="http://www.w3.org/1999/xlink". version="1.0". id="svg7854". height="512". width="512". viewBox="9 9 30 30">. <defs. id="defs7856">. <linearGradient. id="linearGradient860">. <stop. id="stop856". offset="0". style="stop-color:#90bb65;stop-opacity:1" />. <stop. id="stop858". offset="1". style="stop-color:#6ac017;stop-opacity:1" />. </linearGradient>. <linearGradient. id="linearGradient7577">. <stop. id="stop7579". offset="0". style="stop-color:#000000;stop-opacity:0.3137255;" />. <stop. id="stop7581". offset="1". style="stop-color:#fffff

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\status_connected_fork.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):62949
                                                                                                                                                                                                                      Entropy (8bit):7.982829157758787
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:SdnxbIe6YkLsoOgdWTs+yDbw8996DqxcRS47UDuCgrTzs:An76YnsWTs1XLn3yR3VTzs
                                                                                                                                                                                                                      MD5:65997F133AFE7CB19DD8F0C795180071
                                                                                                                                                                                                                      SHA1:9417A78385E193227C1A79ABE9439A2FC0DBB2E6
                                                                                                                                                                                                                      SHA-256:69FDFE1E93313B6D23FC76DC1F71D0F100FB47DBBF80096A289E4B83BFC90CAF
                                                                                                                                                                                                                      SHA-512:441EA59297B6A3B7F31817E4EC771AFC0DCA318FE17E720DCA4B6A43DD3C482C61F5D1A8F75325517BB98F58B3D81452A39C38B9D1112ECF6B10BE1716DD44B0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............}......bKGD..............pHYs.........B(.x....tIME............. .IDATx..y.$W}...7..3./...I....H...Yl...2......n.m.}<}...6.=m..3..=....M!@.HB ....J..}.=c..G.{./+........y.."#c...........W.D.....XHi..w..~_).....R..j.]Z.~..../.O.../..@,-B..._.7V...*...o./=...0.W'.......5zN.`lV...........h%.r.%~j..Y..e..`.......)AV.....?...+...@/..P..............@o..-..J?..8......VJ.Z.I.i..9% .J?u.8...z[j......+..........E.%.j....^S@.-.?%\..\\.\.m..o...@...p5..0....w....r5..b.:_...O...0..{.2.....%.g9..8...8t.8...8..z......8..8....{..K...A....`.--<.....k.I.....O...M9%....qqq.s...B.........F\. &.B\TX.JH..b."....A...BEJ.V_x.t{2...0.l....`..\......+.Fr`...`....&cX.Ml:66.<Y7..F>...yl.W..[.&.L..|~d..`...\r..k..*..C.1..I%.&..IA`.D.S..1B.C.$..M...8..E.Z..X.r1.f_\9..z...k@.."..........n7TZve..%.q.f.....a..l..t.P6I(FP..|-.a.K.&....,r....|....s8..vme*..3..sq.s.....U}.......>%B.J...................5=C^.-.]x...{....}.I....pq.s..d.....kM..Lt..$j8Jev...:

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\status_connected_proxy.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):69081
                                                                                                                                                                                                                      Entropy (8bit):7.98078809957044
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:1W2XgN/85rV6TtUUH2yef8XqdrhXuIs5X9Dq0WL2:fH5rV6Ty5ykEqdNXs5X9u0j
                                                                                                                                                                                                                      MD5:E5CD2C7BA9B105C2E13AE179830F0DBA
                                                                                                                                                                                                                      SHA1:BAB3BCC2963FF0A87B300A02F9FA686CB30E1000
                                                                                                                                                                                                                      SHA-256:D014EC74FE25B357D3DEE494501B4E867CECBC3DCBA7DAF7C9995C388E5C8C20
                                                                                                                                                                                                                      SHA-512:0289D82185D1CE85ADBC84C1046F54A70912E42568DF3CDBD3B649E19FE3B0F62C685C25F3426CC36356C93E52D9D16ACD0DA05A318B31F10CDAC60E76BF0961
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............}......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.........B(.x....IDATx...w.,.y..."m..7.l...@7|.."...4"..pgt$.......@.iGgf.f....GZ.2.8.H.!...BD.$....a.h.}m....{.df..UY...6#......~.2#.."2+~.......e.....;.8...|...^g%.|....7...>..2...]......u/.}P...7.o.sX~o.#0N?Q...o:mC.2..,..C..\.-...>...z.6nJ..q......2....x.s.K..>. .?m....2.n..90.e.....\^.B....@.......... w.t...Ay..K.w4sy=....<......F`...;....2.|.r..A.`C.A7D1.x..).........%..6.9...v.Z.3g...P..9..e..^...\....m.@.s..z... .m.\.RF..<..&..`...=..D......z..F..<.Y..#.[...E........9..As..H..<.Y..#...1s9..F...0.....x.."s..e..s.)...\.)Y.c.>.er2..L]...\&-.@s.a...e.B....g..5...........y .\fS..Ax....2....\.)....>.}}...kgW../#l...V...p.e.o.....,.$...8.\x..... d. ... ....}.....l....w..4.......l.&.H.[..M.....-tv7.....K..y.3.....E....#.e,2..C...n......z8..i...A.p.nx..w..;.BN.dy.......t.....w.It.q.%t..b..U...W.....j...2;...5..e..s.J...n.......o........

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\status_connected_proxy.svg

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):6593
                                                                                                                                                                                                                      Entropy (8bit):5.024087779747235
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:VkoIanLDhAYOKDYmT/35VYfLD++haM0c8XBrTo8ealWBra2BS865MBR:VkDYnDroBgBrToJaYBm2BS75MBR
                                                                                                                                                                                                                      MD5:A73D4FA5DF06DB0120444E5C11D8B978
                                                                                                                                                                                                                      SHA1:B988B93A6EA1466C9F23158508C2130D2AC722EA
                                                                                                                                                                                                                      SHA-256:1F8CB23FD34E40295B39FFE747177C4EE0AC64167DF47FF54754E12916464D3F
                                                                                                                                                                                                                      SHA-512:2D26A2A8FA1E451E5C1D0FB2FC5A3DE471C8F40C4A9E03267A286730F2E8BA73019B3A2923D0F070EB5C3B4EB09AC4D880E2E83B53D9800E5F0DC12910CC1B5C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<svg. xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cc="http://creativecommons.org/ns#". xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#". xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". xmlns:xlink="http://www.w3.org/1999/xlink". version="1.0". id="svg7854". height="512". width="512". viewBox="9 9 30 30">. <defs. id="defs7856">. <linearGradient. id="linearGradient860">. <stop. id="stop856". offset="0". style="stop-color:#479fc6;stop-opacity:1" />. <stop. id="stop858". offset="1". style="stop-color:#0c89c1;stop-opacity:1" />. </linearGradient>. <linearGradient. id="linearGradient7577">. <stop. id="stop7579". offset="0". style="stop-color:#000000;stop-opacity:0.3137255;" />. <stop. id="stop7581". offset="1". style="stop-color:#fffff

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\status_connected_proxy_fork.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):60879
                                                                                                                                                                                                                      Entropy (8bit):7.981421748345525
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:CsVtpUnjIdD7GyXpOsbhtd0VS8ejXGHvAMCIQT:CjnkpBHbCrv5Y
                                                                                                                                                                                                                      MD5:A696EA431A0D5917561454FB73FADAA5
                                                                                                                                                                                                                      SHA1:27A965A78623BA38216BD66365A456FA4DFD848A
                                                                                                                                                                                                                      SHA-256:3587790E9736AAC4DA7301CB971E5BFC256FF55681A2F3F4BAFBBB870FD582E0
                                                                                                                                                                                                                      SHA-512:2CFCD80BB7FC29EFF01FA8080B708CD61FE76DA26DA38621E0861220F2679BD664AF57AA30571E220CEFE7E364449D27A88E78CDB38C3CA44C90D27422A232C8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............}......bKGD..............pHYs.........B(.x....tIME.......>..s.. .IDATx..yt\.}......W../.@.$...$k.,K.#Y^.X..gqg...xz:.....v:=.d..'..Y...t2.]..e[.-.%K.).;.bG.......B.....{......@...[..}..w......]....B.,..T._...e..?+-...Z..b.K....?.\\.<G......_+.^y.X...Y..=.........T.k.Wq...2..._9...8...Z...@..^.)...^.=.3...0..H..2.......G...:....C.....k.K..VA.?....0...rqq.sq............K@...j.%sq.squ.....#V..........A.%.......U@.W,&?%\..\\.K..6X......+-<\.......-;\..\...Q.Q.K@..).....r.Z.r..tp.P...,.1..0......1...0W.@7..G..c..`....PiQ.=..a......'pqq.s.8I..."..T\.)...4x5...`..W9.........D.J<.%..$'@.>.B.DL......D. ..r_x...'. $....$.R.=c9.b...S...(.X.f.......u0{.....Z.e..,.B.A[_...5..4~....)........3.KN7.k...1q.....#...q..8.8.BF....f........<l..l..,.2...d....+s..]r/..L......0W...pi..2....;.!.?.Y...'@.q.:.B.P....d...`.e.....e..yd._..'_...S+S.%W.......$.......<....P..A...J.!.G..C.......2_....B.E....O\..Ipb(...P.Usqq.s.U2.h....f.8...).c... .!..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\status_disconnected.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):66105
                                                                                                                                                                                                                      Entropy (8bit):7.977649505362057
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:GuqnPSCFITkIZ+0PTn5mNUSM9iGucMMVhE3SqiPgkNStsZQ21m9S320:EIguj0NUhUwfBPgp9Gm9o
                                                                                                                                                                                                                      MD5:7F91E463D8115D560C4FB7CBC4227058
                                                                                                                                                                                                                      SHA1:C0FDEAF061A4BBDCD5FA0AEACAF7A9DFB4A0EEA0
                                                                                                                                                                                                                      SHA-256:A0944E10E92347ACEE4F95F57917877123DD18D7E64C0CF13A82EE2C3FE82818
                                                                                                                                                                                                                      SHA-512:49518E5FC4AFFD07F43D9C2E5750E7DAC59DBE55D1BF6D129325CBE03807F1575B7F876CE4152FA8629A2AED476AA46AD1C1A2F55F375EDAF64F723BAF0A6E1C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............}......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.........B(.x....IDATx...w.,Y}...vUu..=7.;.N`.<..03.......$Y...0X..dK~.F~....sX.O....$. $.....a..f.`....|:T......z.].........S..w....o../...4.n...m...4...G)<....7m...g.../...4......{"h...........Q\...W......Z...h;.vy!.h@.&. ......z-\.(......8.h@.......N!.f.d#...Z.mF........4.&..x@.3.4@6. ...;x..!...\.Pi.;...].4x...z".@..;x.zO5\......5O....U"h.l....3.x@.I..........<.k...<.k...@..v..* ....h....5..L..`[.P.@.^......h@.2....h.Q...-6.?....l4..s......x@.N..j.y.....)@.D... ...h@.........[.0.......c....3........;..i....+....zIQ.-`p?..{4....../..u...R.....Po....... .k@]...o@...2.!..........d..P.h...J.B.s..m....@.V`l/0:.....<0..F3.......8@.4..%....#Mv.....)......f9..Xk......|`...k.b.X........x.X.6... ...X.54.xP.y@.......e..tK.N..=@..`.>`.0.....6~{.`......\.....p......6.s...3......5..: ....*..&.J...<...AC.-..M.1.x.....n,.............\'........g...>.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\status_disconnected.svg

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):10522
                                                                                                                                                                                                                      Entropy (8bit):4.949142549545152
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:PkFc0EcY7qRHh6CTChLEEp386Vf1ZvncfIr/9IfOh0Zz2fP:8FemhgVNZvcCicS2X
                                                                                                                                                                                                                      MD5:6D729F445BB3C138010229DCF6D312C4
                                                                                                                                                                                                                      SHA1:2E05438CD92FF5F4274964E432A1B28FFD8E90C8
                                                                                                                                                                                                                      SHA-256:96F4BAE021C1D62AB75259FA48470466F4C26B7AFF7D233A1FC4F686151A69F2
                                                                                                                                                                                                                      SHA-512:19AA7879FCED3D78ADCDCEEBADC8A312C59DC1D151B5D40A01C7F556B2C5717DA271A23D216693B38F49FF09520897F77402E13839AE481F6A565CB9E17C64B9
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8" standalone="no"?>. Created with Inkscape (http://www.inkscape.org/) -->.<svg. xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cc="http://web.resource.org/cc/". xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#". xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". xmlns:xlink="http://www.w3.org/1999/xlink". xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd". xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape". width="512". height="512". viewBox="9 9 30 30". id="svg7854". sodipodi:version="0.32". inkscape:version="0.45". version="1.0". sodipodi:docbase="/home/dobey/Projects/gnome-icon-theme/scalable/actions". sodipodi:docname="media-record.svg". inkscape:output_extension="org.inkscape.output.svg.inkscape". inkscape:export-filename="/home/lapo/Desktop/media-icons.png". inkscape:export-xdpi="90". inkscape:export-ydpi="90">. <defs. id="defs7856">.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\status_lagging.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):74851
                                                                                                                                                                                                                      Entropy (8bit):7.9882419797490725
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:jAwnI3nvBFoq1swn1Yp+FmO2pkTI5pFBKLdbelau5mCVe+3yG0:jAt3nvBFSw1YWmvyTsKLdbcaMe+R0
                                                                                                                                                                                                                      MD5:52621ADCC73C96EDF0F839BB9F0E0442
                                                                                                                                                                                                                      SHA1:1EFADBF184F9193818BB122DBD19FC39BF2FF68E
                                                                                                                                                                                                                      SHA-256:4D83FF89352A47CECB29B32658BA34B3C2B37508DE3F3D219FE183FD3C349378
                                                                                                                                                                                                                      SHA-512:BBEF94F6A79D4BB88BF49B579DF37D6B47F0024A49457B67030CA8258A2114EA947E68953A93CE37CB00BC8766502EAA629E0DCDD8BD11146B448ECE94969475
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............}......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.........B(.x....IDATx...y.l.U.....9......\R.JU.....B ..K..<...6....._.e.........m..ll&...6 !....$.$..@CI5Ow....G..aG.8C......e...cG.8.c.....hE."..?.x......"%.U...|.Q.S.h......h...X.nzb..j0..._.s\.7.).'...7...-.Vt....+Z....1.V.o.h..D.....+p^.Rh..+Z.L...*..p..3.....}..+Z.V......F [.P..pW..l.c..}.....(...@......5..z..O.L..;.......|Vt....`...n..7..b...;...JK^..H+.^.D5..no...r.Y..=.....g.1..:..V...B.@G...-.V..V....F....1..........zE.V...e'.S......";....;..r.h.V."...xE.H..Znc...XS.# >...W.d....-..@wE.....h.h..+Z$..[.?.h~....-.V...M.@s..a..W.X.......r.Z..h5..h^..h.X..jE.I1F |.U4...V...YRbbna....t.$./...Ml6+.jT.U..].............0..c..p6j...<.u...`...h.Q8G..{...|dbE....C..1v...Z/..`..G}\;...............VK@.......|...V...YP.#M...D..YG..;q....l.q...B..B......l....2.v..../."<;..lw.g.;x..=<.......#....c4.9.*..J.....,.0.t[.A.d.#...p..-..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\status_lagging.svg

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):6595
                                                                                                                                                                                                                      Entropy (8bit):5.0234758245261375
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:VkoIanLDhwOKDYmT/35VYfLD++haM0c8XBrTo8eaLBra2BS865MBR:VkTnDroBgBrToJaLBm2BS75MBR
                                                                                                                                                                                                                      MD5:9265B57B15B5E5C2AFB1E4F92D9DC500
                                                                                                                                                                                                                      SHA1:881946F9FCF507F00A022FF588D41A775DAADE07
                                                                                                                                                                                                                      SHA-256:0BF5440323D2A3F305893765345EDBB083B9227BA71C62F653C991B273EE3718
                                                                                                                                                                                                                      SHA-512:446C2151238D088C45B0160C4AB70917CACBAE5280128981C6CEB812D91EA20153D888706AF2E1334B06DD6FE0B36D6225A199C4B59A105344EE5D409EE50C83
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<svg. xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cc="http://creativecommons.org/ns#". xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#". xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". xmlns:xlink="http://www.w3.org/1999/xlink". version="1.0". id="svg7854". height="512". width="512". viewBox="9 9 30 30">. <defs. id="defs7856">. <linearGradient. id="linearGradient860">. <stop. id="stop856". offset="0". style="stop-color:#ef9d29;stop-opacity:1" />. <stop. id="stop858". offset="1". style="stop-color:#c67f0e;stop-opacity:1" />. </linearGradient>. <linearGradient. id="linearGradient7577">. <stop. id="stop7579". offset="0". style="stop-color:#000000;stop-opacity:0.3137255;" />. <stop. id="stop7581". offset="1". style="stop-color:#fffff

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\status_lagging_fork.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):63949
                                                                                                                                                                                                                      Entropy (8bit):7.983366386938507
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:ehB2gJmDdzuAgauCElwpEYrLiRVmQ2Uc37kr7iB7B:eKgUDdHelw7WJeQruBd
                                                                                                                                                                                                                      MD5:AD62F5E3C6CA426533A9716B0D38C5CE
                                                                                                                                                                                                                      SHA1:17E9A7D5CBB7E4B296821DA61B8A5C121B3AEC5E
                                                                                                                                                                                                                      SHA-256:9B9999EE3BB160B7E98C3753D4902D4BDC43AB0519700D9D12F50FFA2D717249
                                                                                                                                                                                                                      SHA-512:38F35A534152AC081D263D27C93FB629FD04718040BC2B4EE5868252257A4833A04A912F3C7028355E40A2DA354FD50EA3979ABC9EFDA3F7D31EB10C0C6BFDA5
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............}......bKGD..............pHYs.........B(.x....tIME......(...... .IDATx..y.$Wy....{.UY{wW..Z.... . ..-...m.B.\....;..c.....=.y.kc0 K.....F.@.HBF..P...V.....GdVge...[.y....+###c9.x....pqq.J..PZh......+U.{....g....Z.]Z.~..../...../...@,-B...eX.7V...bU.,............"..Z.S...c..O.g...`...@+..+~...iKf.bT..........R...@..../.#V.d..^........%.P.....p.e..K?..8......VJ.Z.I.a..9% .K?u.8....[j........ry........l5...p7..........0.W.%.`.(...e................].W.9pC...m~H.8...Z..p..~8.<.X.q.......C.......k`............\.......X.......8..6.$.!.a.D*...S.p......0...b......(..O.......e..E@L....q.".......}..=...P.H.H.u0.[...C..q&sC.p...".a9X..eI..b.X..X..X>.....|j.:.ta..`..G.......%...,n7..x.NLOG1..0.J..D.H.[....@.$..!o.+..i.......7...x#..O..S.i...@..L......0....Pi..2...o...q..*..."...(f..q.c.7....Y.........9...^...z...7le*....sq.s.....P}...#z..v.G._..[..[.p!..f.l...6..-.N....K8./....Ipbp..S....pq.s..d.....j.q............

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\status_waiting.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):81206
                                                                                                                                                                                                                      Entropy (8bit):7.983144606747959
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:uJOWFmkX0woejGhjQw/XVzAVwROKD/mkOrlyIDhqkf9mEenq81CgKt4de:uJXXX0woejGMw/FUVyJ/vuJDZ9Ckg24Y
                                                                                                                                                                                                                      MD5:A3E497D845F86FE75D0B134285009EA0
                                                                                                                                                                                                                      SHA1:8291F177F130EA0EC8B6774E2C463B9E93C6FAF8
                                                                                                                                                                                                                      SHA-256:4AD2A90614526CDBDECA976DA1F43BCFC1DB2E00118711C5A3D39733FB7D83BE
                                                                                                                                                                                                                      SHA-512:1BCDA9560E23AF1C4CEF82AC3892EB4473D2C23009CAEEB4D77E664E5B6C00AFF0B9B9A3B1C7084399BD9648493307BD5905F99BCFBA2230CD451C6C60A2AFBF
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............}......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.........B(.x....IDATx..y..Wy&......{..[j..n.c0{0`.%...5.$...L&...b93....Lf&.M....IB....2.L..0.6.m..^.ZU....}..n.m..u...}..R..V.S..((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((($.k.-.....X.ut.X..((((((..;....L...n..{.......n........!...LUf...U....{..<......$.e......K...h3hQ..M...K.17zbr....c..uPP8.1......0.!....z:..{...y.g..H[.. ...r;.mc.$1.........c...e0....0.......8.N.p..'!.v.z..m....kVP8.s..w../.8/.....g..{]YP..0......s[..m......E...a.....Y.5.)..Ax.....`.B.If~.t.}...}|....0....2.o../..[...9...k."`...kg.....k.&.gC.Y`\.`.. ..0...0..f.....z..k.<t...Z..)(.'....&.}..gHQ.#?..o-......Xa.0}.L.......\........^.3.....G......?`........{i..k...o.O.....J...~..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\status_waiting.svg

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):17633
                                                                                                                                                                                                                      Entropy (8bit):5.101367370782234
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:8wj75ePG9o0fnXvCsenMPWQt0EcFeHLxlWQVcnmN:8AYeXaPM+Qj/WQVcG
                                                                                                                                                                                                                      MD5:B25E3F0A10C42926E4F17DFF4616CA23
                                                                                                                                                                                                                      SHA1:077F51CFB455EED7EA10B1B15FDFA63FDC798C37
                                                                                                                                                                                                                      SHA-256:07D8E8DDA01ECD8E17FE439727287FA4794384E01E9BA2D17D14822CDFF04E07
                                                                                                                                                                                                                      SHA-512:34CC1A9DD6043D522740BD17D30F81F4D0197AAD51789DECEE98330F24E7B60DA072B00E24DF2E726E488105BE1DE6A306C6E0151AD3937A797ADA0806233379
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8" standalone="no"?>. Created with Inkscape (http://www.inkscape.org/) -->.<svg. xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cc="http://web.resource.org/cc/". xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#". xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". xmlns:xlink="http://www.w3.org/1999/xlink". xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd". xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape". inkscape:export-ydpi="90.000000". inkscape:export-xdpi="90.000000". inkscape:export-filename="c:\Tango\git\view-refresh.png". width="512". height="512". viewBox="0 0 48 48". id="svg11300". sodipodi:version="0.32". inkscape:version="0.45". sodipodi:docbase="/home/dobey/Projects/gnome-icon-theme/scalable/actions". sodipodi:docname="view-refresh.svg". version="1.0". inkscape:r_cx="true". inkscape:r_cy="true". inkscape:output_extension="org.i

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\tab_addresses.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):886
                                                                                                                                                                                                                      Entropy (8bit):7.6289522162101475
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:YMd6kufXgEfW4mgdLg0dEWMIyclXDkS1SpiDLgcv3wxVH:Bd6k0PfhbdLgsrF1dDL13wxVH
                                                                                                                                                                                                                      MD5:AC4B8FA4390A63008DAA29AAA572F92B
                                                                                                                                                                                                                      SHA1:95C8CBED0038D022E72D76BDDFAB933477C86997
                                                                                                                                                                                                                      SHA-256:92A0F0FAA9108B03A7F85DC4BB494540C7A121EBF3153973CE0A0B1ADEA5B4F4
                                                                                                                                                                                                                      SHA-512:62580A08F5D9820EDAD835774BB9C844DEC6DE626C9201A2F363924E7BEE3F0C31B76AF787FED645CF9AE8D3C9B55D233CBEB8A1B93C78A9CFA4C6D15852C683
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...@...@......iq....=IDATx^.ZMh.A.~..D{0..F........^.Z...........U...m..&......*..j.&.A....L[5....$#3..l.U.5;s..^......{;........@3...h....:.j../.J.A......[v>..]?I.b..!Yk"......O..!g/....wC....J.!.^.ZT....b...g.D|...Gv..J..Rr.i....\V..r....t.j........P..N...iSe.js..\....%..p.U.>..Q..4v..eV...u.?.:..hW...6..........Ms..s...`n......;.y.....7O.......4.\..aj$.4.m#.z.f.9......v5.7`&....@$d.w.&..`..c...F...[...._.0..........flb#....@...(..t.tb.d.X....x.JlL./.,....*.B..voW.y..F...%....~...lg./..'A.... #.....YB3..j..a..k5X.....>o.7h..c.Kh;7p........!.Q....VX'.j..Z..e..m.....R../=.........P..d.......FH..P....".DP+.dd.....A...Q...[.N.NL..s..o,.n.<..]AF...NPPl.i4..n..wG'A'&A.x..i.h..N~...i....*....5..W..S.\...y.....k.j....cJa._%<.y...g..=.r.............]......u9.<I...h..yD..+..gk............6.....4.0(........d..I^......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\tab_coins.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1592
                                                                                                                                                                                                                      Entropy (8bit):7.788494723888087
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:L0oFc4ZD0wVdHvXH93UmPY3mDVkVJ7hs91JFnueYMv/wEfxW:lFNZFXd3/g3nV49b9ueVtW
                                                                                                                                                                                                                      MD5:1EE6C2BF2A3AA970E939A290903F3AB0
                                                                                                                                                                                                                      SHA1:8B0B56829FF0D439B644ABAC1BDC2D2E1F8C3A8A
                                                                                                                                                                                                                      SHA-256:9AFF6228C45DD2447A0D9E3DAB06D6C10818265B41D61B6BCDC8B8DE193CA6F5
                                                                                                                                                                                                                      SHA-512:9A43B724C16AF2686545187BC565A3544A1A311F5D76DDEC8CBDEFD5A24DC624F648A09749CB12DB89B0C7E21B67ADDB2A1B474DE4C96C37F0A99A27A1B6258A
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...@...@......iq.....IDATx^._L[U.....[h.m.?B#,!.-.......^\|1{2q.1...'...........,.(1dq....2.EXA..u.....B.....9.B.....[...m......s...sz..x!{\?d......$s.......U.c...J7.......A...#..[..q.........+.....BbE..Bi.....=Gj.z..I+..p.j.!'.vPP=.7....s\........6.........T....p...PY/..{**....K......0.6.....u*.%......%.y;X,..@;.r..S.g......CL.@`".X.;..^.n........q.....|.`.T..W.%8..=@`............c...N}..F.j.?.a...%....k.'.....+!...&.(p..k..........f......V.Y.#.IM....,...c.ol......w&X...r.S.<"..W^}....8.2.K<@...U..A.%2..*..?....e...#8.<..ysZB..2.|N%`>(..&.....j....X......O......'...0D.1....>@.....}...d. 1#..x.e..u-.1"....$......o.8..K(PL....I.9.Z-...(fM......z......~.Ky?.94lG8.....H.%...z.......=.....<6C.........}...o.B.e...:.#.V..../...I.~....9..."H.5.O?.~{...<.m..A0.b..\...k...C..@..1t.z#.[.....J.....m..i..d.....U8..{.}....r&._X.T7.....X.T........F..\.......O{...@xy.G.NX....8C.@Y.u~.R}....m...l4.l2B.Q..O..B!,..0;.[{-.xn.6.}..>.."k....>..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\tab_console.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):824
                                                                                                                                                                                                                      Entropy (8bit):7.612514809801685
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:+ZK4Y2G9OPn9LW2qdM46VLQXlt3ePqvHnvM/Yp:+Y4hH53vqJ
                                                                                                                                                                                                                      MD5:BC516311DED0419013352FB03492ACD3
                                                                                                                                                                                                                      SHA1:EB601A41D822FEC612218FF85D03F2E1564AE2FC
                                                                                                                                                                                                                      SHA-256:DB79DC87A2240DA85B585291B442571E98F18765CB493567209E075D6BC87432
                                                                                                                                                                                                                      SHA-512:C8608D97CF82B1E7356E942C33EA5607ABE9E4A91C469CF32879B4FC862BCD18F4EC9F4FC708668598B1EC603AA4D722ADE6D365D90F414C6529793FF175E60D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...@...@......iq.....IDATx^.?l.q..P...hb........J..M...uQ...&N...51N&.h..6e.....&.M...`..Xl+q(...Z..(.5w..Z8...{.......{...w&.|......"...(....T.+.@(.....a.F...w...e.D"..)...0..@...x..+n.....G>l.N.d..D.v....V.)...............$~n1....].........d.m....m...f.V.....Eq..._.).<..1...i..F..|.VxZv!.>.5A.......moL..*).....a...%....'...w.,.....)e..aV..^Os.1..n~...=...9t..q....b... .........pp`..P.P.P.."H....A.....F.:A%.p....L..2...'BA...a.u...* T.PPmy.B.a....B].3.....F.`.?....jMCU.9......q.\..d..H...Z....rn7.+....,....?..ri..$P....Md...z..`..|.8..n. .5x..7_..j.d.z!^...Vwi!...:>Q.B.*....}5..v.PJ.\gG..`..+.....x\..U3$E....b.<@I.Q...4...p.........J..9..:...%..P....@.h0B.!...l...4..7X...d......%..,.b5h\..z<p.\lk.{7.c.Y..........-.......!...."E....{o)..3...<.<_...1....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\tab_contacts.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1446
                                                                                                                                                                                                                      Entropy (8bit):7.8007038316507105
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:OL4aM6GupQZ2f8gnuW7jln85omyLYbyR+6YsHovESL8ee81qKG7TMZXD8bWL8Y6Y:OCDZ2U4lZmyEztZL9e+qD7gZXD8iL8YL
                                                                                                                                                                                                                      MD5:0788B8FF813FDB1A30027FE5365DD696
                                                                                                                                                                                                                      SHA1:990EA3F4929CA78826C8A705A812ED9CF42EBA5B
                                                                                                                                                                                                                      SHA-256:577F8E407B16E76EA191101943A67235F3BBE18715A952A425BEF123DD0ACDEA
                                                                                                                                                                                                                      SHA-512:47C9CCB8A2C77F8D15059760081169583F47EA93A014B775734FC50AD4A5A7C843946BE022F1DBFE99BEAAEC40833CFA5BA28E24BEEC77A63A02124A0331DCFF
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...@...@......iq....mIDATx^._lSU.....q...F...D.......B...X.O..bd..M.....x....d....Hf.<h.h..a.NL..H.)&.!..j..6.........s...'.C{.==.......[F...En?....,r..\.`(.m|.q..g.Npk.o.1........x...I....I%......:p........'C...d.Y.j......./..<1....D..<9M.V(nx...W. h.4GRo...Ti.c..A....O.\..D4u...I....J'...V..hj..-.E.D...t.j....0..0..t.."k............``!$.W... X.Y.).H..&...2.U....^YO.v....0..k.h...9.<}........2X..(..w.Q...h..gc2.\.....]/x.....b..}...5.G..!..y.........<5.4Z..-...q....z......XEH......W.....]D..)Po.k...@9......*6?....l$.....<.=w..|.p`x3...V....M.(..y.6...s.........I..e..~.......iU....R.7+6.....[.j@C<.yb.l.o~..-[...r.e.D.S'... AQ......o.PW_.,..>..X..,.o..e...j......c.v...e#0aY.x...>.{ES..|a....J......./..R..j.....^.0.ECJ....s3VJ4N...{..-..:P._4....P/...{f.g...e.H.....$..{On...........e...b......... .?5...O5.c.Z..p....O9_.%..AL. ...V..@M..{...Fd./.........h...:@...(@..N...>{?.Z.e......J.$.)5.*q...T...Q+G7."|.......4.....`.....z..e..vw&...

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\tab_history.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2182
                                                                                                                                                                                                                      Entropy (8bit):7.871959525865307
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:roXG+Tqgihlr7uTJeZjuqGBeMdcfYSQInowB5SNpuFa5FEkNcE+krsUaMc:r7lS9afXFowiNlSacEdslt
                                                                                                                                                                                                                      MD5:EA743BB14A4E4163525396D7E493851F
                                                                                                                                                                                                                      SHA1:9E7D59B26AD3EC8514B5284314C10099C6C81AFB
                                                                                                                                                                                                                      SHA-256:F6AA1E2287CBE64D4D3248DEB96EB506D619898BE1E4726A75565FC3148BABAB
                                                                                                                                                                                                                      SHA-512:5AAE68B6CF0328CBDC0FD6A9D236DDE6375D82B11A34A98F9577CCE7A87199F969EE124CE5F82B7EB109BE68C723063778506D34ECD7AAD251010745A0E0F5B8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...@...@......iq....MIDATx^.mPSW....$.I .......,.C..0.t.E..mgv.]....H;.a;mgZ;.S.e..3uwv...l.n...e..F+..6.TP.% o.BH...xw....D.r.....p_.9..<..<... . ..G.@...@D.a... ..@D.aN ".0w....H`[...4.*....p....ib.l.........M......8..Z[............5".".p.$`4.b.j.y.#.$E..R)V...T..E...v..-]79..)....~......V.!..x....:.o......BvJ:.e.#?5.K.1..&..h.n...Mh..X(D~V62R..... +......[.+.*%#(c..w...3.A.!7=....|....?...m.f...m..#....x..@@.....q... ...|........E9.y... ...E.....sS..W....O~..q..]W2.....X.'.g'..k..IL.}j./R.3...]}}.1.2.. [...,..q.>W.D......x.."....Ue?...u..&.._.."$+..<}...N/.4.:9....K.%...1}..$Irt..hK....F....!...@..M..C.#;..........<H%.[....J..EC[Z.....?8[...~... Y..u.._|.K..>........'..H..id..PX.9.#}...p...b.\...R...JlX../iy...H..lM......2.Q..?.j<......$......<...W.....k..0....F.?.....?....8......g....`..._...`.y<.PV..6....;^=..G6A..M.o...e..J`O.>..."-.]D.F..EGA[..O.7....3HMNF.R)s.r...z.=;+~..'B$....m.7..=[.....).B.Qw..\..,e&..!.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\tab_receive.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1873
                                                                                                                                                                                                                      Entropy (8bit):7.847348495097636
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:ack/QtTQik0K+GNXSwUmiK8OIkg+t/zTsFB8QHqMl7OW:ack/QdFK+yCROIkg+tbogQHqE
                                                                                                                                                                                                                      MD5:759229A9E6A227E749479D3E38ACCAEA
                                                                                                                                                                                                                      SHA1:59A1CF1616D6B0EC427E1D26A20BD3E5D17F0905
                                                                                                                                                                                                                      SHA-256:F589CA31504FAF427C5AA7AD42E413D0808A4168CDEC02B09858A186460C1E09
                                                                                                                                                                                                                      SHA-512:73090EB181BE0C3DD8961D1E96A8FB9E08F6CCEFB8A2AAFA3BD9C6D6A729396003E0B5DD5AF34A2D7CDAAC786E566B2E6200352EA826ABDC6A402C2DD140C67E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...@...@......iq.....IDATx^..O.U..g.e...-...h..G...|..6....5e..iRM.&.&j.J.....&....`..6.P-.4&]m.1...J...X`....2.;...j.O.=w.9..g.C......c.....s..[...p......h%.-.c._b.y...b.[R.x..3.to*..`..H.r...X.X J.....I....O....q.......~:@DGS..v..`.\.;....W.R.A...,.HI(....m..H..G=.........<.^`...J....O.....(.!.../w.|.a.@........MK...-..i.... .f%.?9=.01u.,.w........86Z....a...j.......iY....I...f..X..-..:A..{LN.`...V.3..N.o.. ....X...../...g..G...0.b_W.kCz...1.@..u7q.&@./.....[...5..kw...}.>3I{....e.kA1....N".N_8......a|....?..1m..>..*.l.f..%.........O..............m./..g]...^..+7./.Wn....W153.....m|..{?.)..S.t.`..6..1R.........P.....>."....#A..5..x..2...N....zo.......@,....@....z.0c..t(g.l$...`.......0... .) ..F.....P.m.v..*9......f8.|s..^w..C.:........3...}@z0.L`...<...#x.@..KW....*55$...@r.....K+.K...?.Ba... v.i....|......`d.o..a.|......Xd..;:.z.Y4-C .,5.c.Y...t..oZ..I\d..{#....>j....5..|."..L'....W..#(@.UE...=_.......A..Y....e..Hx.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\tab_send.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1550
                                                                                                                                                                                                                      Entropy (8bit):7.801347642580139
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:P/pJ59aQ3CDH4Hr5r34AkCO7uN9fpsTrq:P/D5913oHOVrocUufCrq
                                                                                                                                                                                                                      MD5:60E2D5CEDD24680A2ACE067443AD2621
                                                                                                                                                                                                                      SHA1:2E262FDB4BAA4F0825BE04CBD2F8CA8C2E0AF791
                                                                                                                                                                                                                      SHA-256:FD2BEBD2DEB05AA9A4EDBCF112A42AE2AF4E40608D58197A96AE2EC15F3104C2
                                                                                                                                                                                                                      SHA-512:29708A046E52327A79D141056D1280878672976A863D7A120A5CD13D78B6D1B02D83C6D7776B03F772E0837FFD1BD1FA60BFC5B0B8D042B48D761B7454FFC106
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...@...@......iq.....IDATx^.[L.U...gw...[..z.n...XJR....J.h.I....]..E..L.(....|....hb...bL..6`..@..R`K.r..9#K.ew...v.v^x.3.|......-...!..Q......DS`.. ........].<.O.[*.\>....k..O%@.....m2......{...d...|eN...|...;......M..pA.qwp.iI...(.w..sN.@3>:...^<.a)......1..f...1.4va..1....d...@&...1..[8\..X.i....k...E.8.....-.C.B.Tg..X. .N...t...W..;.C.."c....c..X...N......s..?....X.2y."...a!..8........kp...(Z.....w85....... .....%....P.%3......D.5.N.G....A.xez.^)...n.~2...C.@.8.lhxR..{C..fjb,..]..1..;...(....Au...V.I.G...].cey._.G..u.@.8..;....q........*..|....QX+..#..v......@..>...K....Z....Z.i..cN|w.....f...\....Ex....E.P.i....q.+..p.....2l)\.....!..*8......\.N.f<ykRQ.=..>..k...8-^....\..?..../.....<i..*.x...G.]..{.Gf.''Xp.,_v...H....E.y..A..F..nd.5.>..#...83..C.?............F..vk.]i...~..H..z.KK.S......H...aU..zA.i..P*^\.BCKO.O.....Ej..i.W%.m..M.2.pV.8....x..s?.'.o.D.=......~T.......o.".....(Z.......@.)..o.".]..d..e........K...E0.e..3

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\tor_logo.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2712
                                                                                                                                                                                                                      Entropy (8bit):7.897509548266366
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:OBYh6wWjHXqGQla23JWOxBqj3taKc6U6pt8XCFPPJsKfinrJHO10knEmRXsHr:OrL6rla25WOxBq7MDN6f9x2KarJMtnLo
                                                                                                                                                                                                                      MD5:E984E43EA26ABDE50C0679243413BE73
                                                                                                                                                                                                                      SHA1:1CDA2539FF5AFEBE8B0240A7A53CEC96E59166BF
                                                                                                                                                                                                                      SHA-256:D3B9D45B853AC0ED8040743435131943A290BF477F84FB596C3F1B1788CFFECC
                                                                                                                                                                                                                      SHA-512:E751D281C2E298FF38B756BA93EBBB3DC355A73DDE2460A1AC9E9EEB9163C2558E7399A5A0BC8441DEED2CC1F068980B8F700BA03E9FA802B117D0C7CCDB5B4B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...@...@......iq.....gAMA......a....OIDATx..[iPS..F...T..HE.DCN..e.(.)B.D ....&..Q.m.."*j...X.2#Ej...Q+.Q.*..T[l./s/3....yO=.IH0?...7......y.wy...ttF...q:cy...u....#..#...?7._..A.#.......g....}v......k.K..o.=......Z.)zs...:..to..m..r.1......|...5....R...n...=.p...[..5s......7H~. .H..ZC...M..."_.L.|.....v.............;}..o.j.k....;.x.|.U.(%.T.]..?.Oq..Pt..j;..5......P.dT.&.k.1]._"....2/......;..9N....5.G5..j.y\.'Yu..X...Y..R....H..`.K.g..g...=$oo.u.O..X.q..].d.!q.....?../$..T.6...V;.....o..L..X)..4....&...2.P$.59i.l{..)$.0....Um.../m.6.:l;...A[.......7...9gl.Y%L9.D.-d...,.].J.=~R.u...o...#. Yd..V.B)dGY...&...\&..ZA......q&s...U.zzSP.....^J...+../....<yr..Y.K.X....'...=.\g,,..T....^.:...<`..L.....?q<.}..f......"./..B..N...3p..5x+.v..8..t...........{l..d..XQ......cC.GG.FE..O5B.... Y...gd..Q...h....o.[.n..Bhf6......"x.e..../W..].......h.w]......\.<]...............l..}b|B.=........../#.(@.........^........v..G.<......}}"9.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\trezor.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2606
                                                                                                                                                                                                                      Entropy (8bit):7.87590276765234
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:9GyHy2I0ptxc7rfVIZzhMUinp+mLxU7bM5fPfN3bYgZUdyXcj3:pS2NHWrfV0zLinp+m+7IBZbYasr
                                                                                                                                                                                                                      MD5:BBFD133D7E3BB9166A72AEFF44039DD0
                                                                                                                                                                                                                      SHA1:B793265348BBC090AF7B9E860FE08D75477A9F22
                                                                                                                                                                                                                      SHA-256:FBC9CC7BE4BFBC63D013177A8D5F6D45E5B803F3AD18B9D3F06ECE241387DD4E
                                                                                                                                                                                                                      SHA-512:69787575A49FDC93AC08F0E19FF138DE9A8267A95A6D6809F90CDBDA34E511226F397B860C9BA66A2BB39A4CF2117F3939723866C119BF1BCB560C03741F8B4A
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...P...P............bKGD.......C......pHYs...#...#.x.?v....tIME......8X.<8....IDATx^.kl.........N.b.DmM.`S .K#....m.u*.T....j..-Jc.J..AJ.~HK.*M..U.xT)`.A...VI...h(...[...l.w.k{wo?...].xf.3.......{=.9.u..f...,........+.%......H....x.8......u...C..`-P.|.....L.....^.-...{...ow...F.(p.H!/o7..A..@#p?w.K....L^8...~.....Cy.....\...._.[HWp.!M....:.t.....Ch@F../.....s.s......N=.7....#T..bz.K.3.......4.k.n.7.!..@.H.#.i.P.=...<.Ly\..,.M.._A.|VP@..W...9D.A..V!+....".n+BjH..G..&yg....7kb.i......z........0.y..._A..y.\.OX....Ad.l....HS7.C.....f k....K....u..R.<...fu%..0.:{F...F..f/.>.E.b,.!ducf.)..(./&w..2..r..w...s..qJ.......^\...[......2..7`.....v.L@..6.4Y....vf..#.Q'..t.f..2.L..)..`..2....`..X..ADt....0.>..cw..e9....)..Zf..Y.s.3a.~.N.S...F.`..u.;.6b../C.t..q8..2Z..k...d_&`.{..S^6..1. ..%.%\z.v:...).A..x.&....:U..\..,..~K..X0..g.f..Y.sdV....0Gf...;..;X.......S..p.8..M.>d_..f.s...#....f.]....K.A.}.f.\d...DrdV..q..O;.P.,.....X.v-ee..s..........9{.......in\..m..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\trezor_unpaired.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1950
                                                                                                                                                                                                                      Entropy (8bit):7.797132462932182
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:9dpnb/9pz2F8k60ff3UDxvElEN0qaJQsAhgFYQ:npnp1OUDxvESNKehg3
                                                                                                                                                                                                                      MD5:DD744CD63E82BF20B1869CB2574E26EF
                                                                                                                                                                                                                      SHA1:C0AB173E75DF598D98B6CE2576EF01DD0FFDC6C3
                                                                                                                                                                                                                      SHA-256:CF02055B85C86E9C962C3A9CDA299D90A378364EEC244E31ED5A17EAD2D84C81
                                                                                                                                                                                                                      SHA-512:28B6503F1CDC9620BE79C5764063576FBF3E15E3264ACC0A63E9DD6C8A83EEB61134A2949DD7362F2BBB830DA0CF4EA7E38D19D1768F99149AE831352699D962
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...P...P............bKGD.......C......pHYs...#...#.x.?v....tIME.........L...+IDATx^.[h.U.....4.D.T."...".[+.mFQ...*>..Q.... ^C..}(*^../U4.`E.^......"D...hic..5m..._6.nf.........s.......)T.E. D..f."...l.T.x`.p...v....&.W`.M~e.....Z.%@.*.4...;...v.?..O.m.........{....^-.....+..8.8.x.........u@-G)....c..).2.o..hUp..CC.'..:'..t.39J..m5K!^..G.z*.E.7.V.....Q..F ...<.em.p9% .+.....{.....v.. ......Q'..%..Oh..x.,.v........./.-.x..;...\.\.v....C...w.i#....M!&h.....4.e6.i...k.~.yg.....V.'.......A..^..<........b.".bt.a.....p.}6F..O.u........gG....:.7}._.....tttc.....0.>............h..?.I.S.....K(..`7LG...B.@..oH....D.<.DS.b.J....3.8.N....hu`..h4%*......L.!.......k.5......1...G*..p.W.#.....*.O.....dB.z.K.S...N...../...y....8..p.4%tA.....<....O........d.!\....Le....u...PQx.@.].B.}.X.+.,.......(U.}R..'U.}R..'U.}......$a.D..H.....+b..].>../a.8....5%..&t.."..]..3%....]mD|R..'a.p.,.1.H`Y....46.........Kooo....v.p.B...i#A../u.#TD$!".ccc..."

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\trustedcoin-status-disabled.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 50 x 54, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):19933
                                                                                                                                                                                                                      Entropy (8bit):7.574534972019669
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:lo1/vtK7MqGFjjvOBncKJ3aIXnXlyY7pZnwVAreANbBk2/urYl:laM7zGpN+aIXnXlyY7pRwVAiIba2GEl
                                                                                                                                                                                                                      MD5:64CDD6A1BA368CC80D4722DD87125C2B
                                                                                                                                                                                                                      SHA1:CF9F64404F9422B5722902909279B3D47F0BC5E3
                                                                                                                                                                                                                      SHA-256:F48994C54E979CF844F8E47E0FAA309E45206FAE81B8B28EF26AD3A703512056
                                                                                                                                                                                                                      SHA-512:D57AE5788EF747D55D987FD335230666F7FCFF12A37FB217240AFC1DBE9B0797EF0A28C0D17086CC38FC054B50D64D05AFE6D0490AB8C787EF524061244A1FD6
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...2...6........../.zTXtRaw profile type exif..x..i.%....c...L.a9...-_.Ad..j..."+...F ..38............./.[m....'.........;...~.......T~~..Q.+..m??..~.~_..2...v..~~1............F......=....s..=./..?.<.......N....a......6.b<)$..1.o.I.E..~....0.....R.?.cB.m.~.....P....r..........K...\~....`.."..O...s...............v.3..#....<.Gy...-t...Z...K......P.~...z....9.0...}]a1.....ob\1...Tc.+}..pcM=..X..'~...%..v..[..;....XP\.......{..A..~.q..f.Z9...X.p.&.......?Z....fY)...]bZ....[....._.......qkc0!...ZH.J.5.....X...c.q...,n..s".jlQ..-5..F....s....TRemz.,V.F....A.e3+V.Y.QR..J)...GM5.j..Z[.u..r.VZm..6z...^z..>...\y.....q....Yf.m.9...UV]m.5v.i......{.p.....r.i..q......n.......j.'m.....Z.Y..VJ/..W......ApbZ3.,..X.% .....s..i.|.d.E.iZ...b.`>!......oE.r._..j.....sZ..p......m..z+.e.&.'.o.......W.}...V..R/L.M..[.n;..v...Z.#..N....#......N....Q:..y..;[.'..}....S...]..k..{.......{.....,Vn..^.............\...Q...........tk..F$|2a:.l5..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\trustedcoin-status.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 50 x 54, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2034
                                                                                                                                                                                                                      Entropy (8bit):7.660239465649274
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:0li631SscJ1VE7Nmo7qs4Q2Q0ZfoekC7XHln7tT0ny5SLsE1Abr:0LFXczVaNhSQ2Q0+eX7DZ5OQ/
                                                                                                                                                                                                                      MD5:2BDE89330B50F80C329AE96218ED4407
                                                                                                                                                                                                                      SHA1:808B69490EB31F7DDB389C40C873A1DB3AE072C8
                                                                                                                                                                                                                      SHA-256:59483C610D70606C486D6124BE50FA8FF11CD135A8C9E01A23FF6B6EEF34AF0D
                                                                                                                                                                                                                      SHA-512:E0BBF4F3D7EEDCE48FCBB9D8AB40097BD56CB6EB49F257228CC96F05140D75EBE8348E9EFC840FFA8783B9FE1EA104EF51C58807DA21F212FBF15D961810AD39
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...2...6......p:.....PLTELiq................E......................T..................}........2......<.J.............,. ....z..`...........r.......V........v...6...........}..............H.s..................O.7....................<}....Q..N........................6.............F..................................".................................................................3..............;..<.....-....3...........*.....t..........!........M.............:...........g.................].....H..k.....T..!.....W.............)........l.....:.....a..t..s..%..5..=.....G.......z.....;..@..m...................o..S....s.........a.. ..........................O..b...........].......B..f...............J..........."..I.....J..........P.....|..w.....#..s....P....ZtRNS......$......9@......../D.N.i.r39.....a......F.$.....b...\m.g....>..7.d..d#...Tzv...F...(......VIDATx.....$I..s.k...me.l..m...m...t...55.......2..#......6E.C#f..b........Ggc.I+f....e....

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\trustedcoin-wizard.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 60 x 78, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2206
                                                                                                                                                                                                                      Entropy (8bit):7.856793550146874
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:RtLYoH20oBpJMBYgo2ZYvCifHAWvJRtt+y5a7+ZN:/8oHNyG9BYKiPBJRtt+OawN
                                                                                                                                                                                                                      MD5:4319812521C3BBEBB5A1CE0921C67FC1
                                                                                                                                                                                                                      SHA1:23E7B2283D9B181ABBCE90808F1175CD39BCDE66
                                                                                                                                                                                                                      SHA-256:F4FC9D6E66B0C812F34854C5047506268C16B861056DF140535A263A98B6281F
                                                                                                                                                                                                                      SHA-512:6FCEE42CFA23683F3DFDA3D6BD6AB8242ECF758BCCB7CA59B8A7E60D1173FCA2F1F420CD4E277E904AB658781F587A2DDA3887D61EEC42684E511C81B53ED10C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...<...N.....K.....nPLTELiq......[[[Y^b......C.....K..............\\\...................................]]]]]].........XXX[]_.........ZZZW\`]]]............[[[...TSS......^^^]]]......`[Y...[[[...^^^SSS]]].....B....]]]...F...............................5.....F..-..&..... ........k..N.....\..............p..;..............@............................V..........b........z..^^^.H.r...EtRNS.%.;.-.....h...Sq\.q(.|..J@.f.......FP~C<..N........E.t...6:.:.;.b.4+s....IDATx....w.>...>*3.v........H..:.033..k.q.Wn..[V.Y...2........>.?.....|.....VoIn,}..*`....M.G....Hi...`h~yc.Zp.......#.._....&..~....G,n.y...pc..._,P..=^S.e..N........\.z.Z_.d.....,JJ.D~..Rl...~".b*........(..BC.].r.+....TU...&|..sFn.~O(^.+.)W.%BEO@..L..[....oF.$...r.N..j.....~.Jx.....N....2.....[..7.......'.....c.....-U&.....).l...Q?.(.#......p....9g.sx...rFA.......1...TUp..........ef.qi)i=F..o.......-QN.....FL..D..m.9.S.7.m..J....hTv....+....r......Z.:..j.8 D...r...p...a..X..X

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\unconfirmed.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3532
                                                                                                                                                                                                                      Entropy (8bit):7.5891737213090185
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:f3QHXMNzJUXj8XPh3otxZLXjnoGbx2qXMhgkgbSBAvdYKeTJua1xTXhh7s/q:vQ3yqA/h3otxx8s2GJdYPuaF
                                                                                                                                                                                                                      MD5:72677CFDA5DD751DFD4E1077ECB499A3
                                                                                                                                                                                                                      SHA1:F157E625D084EE85E8028230C6BC9E002CA86391
                                                                                                                                                                                                                      SHA-256:A3C8EAB530A557686719B32027753E6CC6B0DEE76AFB041FC01951A8611B05D9
                                                                                                                                                                                                                      SHA-512:D6B9CECD94973BD79868C833CBA45C7CAE9D6485205FA8D70EE031F4F596B74BD7A4909FBD256F4ECA932FBF124837DD9740FBF6A45BE93E95572819C7A532F6
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.....G<ef....gAMA......a.....PLTE............................................................................................. !!!"""###$$$%%%&&&''')))***+++,,,---...///000111222333444555666777888999:::;;;<<<===>>>???@@@BBBCCCDDDEEEFFFGGGHHHIIIJJJKKKLLLMMMOOOPPPQQQRRRSSSTTTUUUWWWYYYZZZ[[[\\\]]]^^^___```bbbccceeefffggghhhiiijjjlllmmmnnnooopppqqqrrrssstttuuuvvvwwwxxxyyyzzz{{{|||}}}..................................................................................................................................................................................................................................................................................................................................................................................................................................8.W....tRNS...................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\unlock.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 480 x 480, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):45956
                                                                                                                                                                                                                      Entropy (8bit):7.971545234009563
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:8k9/w9PXN26vaXa92He7owtuKnMfAgqlQNkpBM2arxIJOaLfPtWfFMlHJLw3/Z:8k9Gd26vaQ1PM+QNUvIxU5Rw3x
                                                                                                                                                                                                                      MD5:EE2E1C80E44FEBF375BA777918A9FB4C
                                                                                                                                                                                                                      SHA1:138DE76DAEEF169D9FDC9E332B4658B010C8C65E
                                                                                                                                                                                                                      SHA-256:AD0BDE11FD020914782CCAFC15EBE2C9C01F28D262E51CC8983DD79D8D9DF5E4
                                                                                                                                                                                                                      SHA-512:C926201F15F64954B4DB42C6C38368A4C10BA641AA2559C49174D09179648697966C48F6409E32773AEC60F21088ABCA89CBB75EBEDAE94CF1DAD6899581A798
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............}......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.........B(.x....IDATx...y.%YY.?.efUVVuUuW.;.8......*H..4*......7d..b.Q......p.....(.2..#......]]kV.v.8..sN.9'".yo.{3.Ow.}.q.w9.!..01...G..qTu.Q$t...3V.8HDK.^".........&.....`4..h....KDk......4.G..."....b.....^m......y.s...5....M...a.y..^}...k.u5..g.5L..X].......(...u.g..a..1.e......y..su.?...<;....... T...j...........[.t...i........>M....b......K^...>8A.WD..}..'...P..../.....U.>.9.4.O..#.|....o~.?=.)OI.}`.0.....W..U..4}.4}........g......a....A../^.|n..%.......y.._yK..M..&.....i..>.K........w..8y...f.a~......y.k..:.k0...o"..i..P...?............$......'x.k_{+.~..O".Q..i..04.............$"..A......W....0......C.}<..........V....Z....s..w.}.F.{H......>.a.b........._M.`.a......3...(..?..?j~.c..o..3....H..b.'....";.(...f.).......0)..S EPJ.q..RHT.R.D%.4..(.|0]e..=&;->..BP.U..p.$v.....343.5.6..._.....H.4......a......,....Ms

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\unlock.svg

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):19461
                                                                                                                                                                                                                      Entropy (8bit):5.028084132524802
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:sbom6MkCX9CwqISAHSc/8EqFzvacL1a2oJtcLEY:s0Tc1/jsvacQCLP
                                                                                                                                                                                                                      MD5:9C4D31CD803676CA56DE268BD1AD7635
                                                                                                                                                                                                                      SHA1:823208D92351211A5FEEF301D26E62515EC1939B
                                                                                                                                                                                                                      SHA-256:75F4AAC7999FC470270A75BDE3C73870C9D8E235CC40AED0D04830B46471A30F
                                                                                                                                                                                                                      SHA-512:E7DA269DDCAF8B1B37C28C0B39B6A33D1D46022CE12E38CFC81B4D8D7197FAC2C7CEB8AD134675C0D7E4C8F0F8E5B21FE51999E28F860A60AEC6868B18759EFE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8" standalone="no"?>. Created with Inkscape (http://www.inkscape.org/) -->..<svg. xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:cc="http://creativecommons.org/ns#". xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#". xmlns:svg="http://www.w3.org/2000/svg". xmlns="http://www.w3.org/2000/svg". xmlns:xlink="http://www.w3.org/1999/xlink". xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd". xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape". version="1.0". width="512". height="512". viewBox="0 0 22 22". id="svg2". inkscape:version="0.47 r22583". sodipodi:docname="unlock.svg">. <metadata. id="metadata58">. <rdf:RDF>. <cc:Work. rdf:about="">. <dc:format>image/svg+xml</dc:format>. <dc:type. rdf:resource="http://purl.org/dc/dcmitype/StillImage" />. <dc:title />. </cc:Work>. </rdf:RDF>. </metadata>. <sodipodi:namedview. pagecol

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\unpaid.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):23805
                                                                                                                                                                                                                      Entropy (8bit):7.980170255740335
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:j9adJPzcKTRQo4DDo4UBlXLP2NuEuGFP6ZvQMsY4bdn+FrBXDwlZL1yDDqOxJ/tL:g5zcKTKFD0rXKHBw/rSl1k31RaGXUm1
                                                                                                                                                                                                                      MD5:C1AFBC88ED47F2FFF0C8B0E9C93F3B60
                                                                                                                                                                                                                      SHA1:71EADE1D4D878BB80FE469D169EBDAED81342A23
                                                                                                                                                                                                                      SHA-256:FC8EB93843F5D2933F409B4EB990F802B1127663FC1558BB50B9F016B05A7F1C
                                                                                                                                                                                                                      SHA-512:FA4B918E81D56ED7A0220B4992DD9287A2F100E7FAE28294E5ED7EA488EE9F391070FB2D3B643F6A750857AFF64D74A769F0C867B416ABD8169CD7A70EF614DC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............<.q...\.IDATx....U........kw..v..k\;...PP..AJD....E..D...*!(..X..8......}fo.....c?.{.>{..b.]_.7..b.......N..+.v.a...n..n..byyy...w.9..6..*U...u.]c{...w.m..g.......*V.h...o.......q,....e...[.9..~......;.......4........U...cu]..g.'...c....j...A.}..'..~..e.=.L.&...*T.....w.M.7>.3......;.h...>...|[.9...|........<_.r=...X.z...G....}u....O.....}.ca.....G.;.t.i}6X....{./.N.....v...OJ,....?w..u..i...%|'..o...%.,.g..}..C8...5r/....J,a7.s...[...w..L...za.0Z.y.S.i...A.*j...>'.......H+...xF.at.F.m.k.C...?`....^.mt....].D.X..g.}....J.......}IX.Q..... ..e.{K&.E..C.5..s.9.S.E.]dn...S.zuS.V-S.n].A.s.}..{...u.]..[o5.....Yg.e.;.8s..G.....G.gt..|....M.X..9Q.....&..L,}..}.W.....J.0:..F.....9.c....cG3|.p....3f....E............_~1../...._-x...~...\......3S.N5.>......W.......G.i%.d.:.r..L.>M.v..u.......1t.j....U}...N.......T.b...J.ys3v.X..G../.............@.H........l....O?5.g.6.f..9s...?..3.._.o......A..K........}_|.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\update.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1580
                                                                                                                                                                                                                      Entropy (8bit):7.778938064983873
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:iB4tZ84cyC86IswaNFeUd9gcBTmPNv1K1z+t9MWDCU:3Z8DySIsbFeUd9lYU1yIWWU
                                                                                                                                                                                                                      MD5:821FECA097D7DE35F0EE7D1C0AA03635
                                                                                                                                                                                                                      SHA1:88803F1BBC066A6A6BE8722610AD3236F06E20BC
                                                                                                                                                                                                                      SHA-256:D5A0ADA0CFA3837F27FB804582BD5F42AE60DD3A7EE58A51775EFAAC44A2C262
                                                                                                                                                                                                                      SHA-512:0F6ED76BD84B055C7269367813D07235E7A77AEF70CBF9D1EFE9303ECF87C3BCE51384B25E50942BA233E957B14EAD51123E3786B23E763A90298C96583AE1F7
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...d...d.....p.T....sBIT....|.d.....pHYs...........2F....tEXtSoftware.www.inkscape.org..<.....IDATx...]..e....3....;3J~`_d..D...9G[)*lSB."...... ........(....>......... J.#qf..7w..O........9s..].....g..y.}.@.!..B.!...i.=8.:....*..*.YY....G....L........%i.KC.7....~gU...+.......!.@i..l".....4.!.....e.m.C.. iH.DX..;{N..7.T.4$6.>\..w.6Q].......A.....x%......;.b;.......=.U^).VW....g...&.!......LY....p..b....;...6.V..h"ufl.JAo.B.!..~w...L.f..g....fPPqw.a..y.].X...1..z.....<...$.U.}B.~w%1..Y3.._[V...0t:.2-.......f\B..D3......w....."..]-v...w...X..t.i....6.^gi.lC.....*t.3.....;".v..6.#.7Z#...u#.4....b.j.:....7..cD..-..t...............jh.2.A.Y.E|y..k.......Q..W"..R.F.l..... .A..W...ot;r<.m.."W../.p.W...]:...".E.&..z....NDv.cI6cD!...........N.L.d./+ot..QHC.L...4d|.g.(.!....E....R._.Y3Fj(i.)m<v....C?f.^..B.!..B.!.hf....Vf....f.....D..g.36{. ...er.=.8.(.w+j.......P....uJ}O=.......3..<H.!A...@/dcl\..b..mA.......3...k..*|....Z..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\wallet.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 49 x 44, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):824
                                                                                                                                                                                                                      Entropy (8bit):7.558816816333435
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7mYMC2s/6TbRBtTgRM0I6IlqsRt4CUMQL8rCeIlEm5SQlcjhZ0EtniYerognT:HO2s/6fRXHYODt4gQ8mDlcjdtAEIH
                                                                                                                                                                                                                      MD5:61F57C284D23775E1D16EF041BB07A9D
                                                                                                                                                                                                                      SHA1:8AA2AE436DD6365D8AE600DB715760C57EFDA20D
                                                                                                                                                                                                                      SHA-256:BB8B3B769D9E22053F3DF5A842A48D21BE6E1659D4DBEF7E09F4AB5EAD7EF509
                                                                                                                                                                                                                      SHA-512:A1EAEF3131A82563607C149421712E3E9262726442B6B62322F05B510010696943A296ADB3214CCD3B5DA3E1B5F6B1AD9F1473D7AFD80D7D1E132BEE5B251751
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...1...,.......PY....gAMA......a.....bKGD..............pHYs.................tIME.......(x.*....iTXtComment.....Created with GIMPd.e.....IDATh..?h.A...7..O.1.R..!&.L'iD.(X....b.!D..l..L.&........A..J.0...X.B.d.....'......$.....m.WM1..1...f.;.6...6.m.QSJ.l.W...L....4.!....+`j.........h.3..<2.+..r...Z...F%..s}]O$,s..M.h..p....@r.l....%{........[....`L..6.....C...r....}'.....<.U.....;....5.N.s.&.6.0:.?.0..R.]+4.zb...J....)F&..v.Im...@..8l....`.a.....E......eo....b-.....P."Y....2NZfWU.....F...$.a..^..Nn.B.".O,.<.Z...&.MQ..9.Z...#)..$#...#d.S..a...-_Qt.j..J8...d..U3.T4..../C....2E.)mu.UM.......\....w..N.|7....A...6......a.#...`..>.)./..%........;..G....Q.C'..d..vt+1/\^.l.{B!.@.fk.%2@y.=...1D..C..1.!R..K........B....-.a+3qr...B...G....$...2Z.........8;5)~......Z`.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\warning.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 150 x 138, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4839
                                                                                                                                                                                                                      Entropy (8bit):7.937332736620083
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:MKNL4/3sotYG4AcBAvnnuFuNIZY3gg95nqItMewv7EOWTbZwZxeTn08FunI:MKNM9tYB/BAfwY3dnqyMpv7BEa7eT0/I
                                                                                                                                                                                                                      MD5:C1AE18250A3845EDC5E015F6FD7932C5
                                                                                                                                                                                                                      SHA1:FA5FDFE17E4FB0A9F2CCAF4BDCC2FF75B34BC94A
                                                                                                                                                                                                                      SHA-256:541AA0FFC78F1B11C16ABB5AFE51FA1465D383EC4D867981D6275838F526D0F1
                                                                                                                                                                                                                      SHA-512:19726DF6BD213F4BE99C4EF0585901BFD0A2DF7A174F17B71D7D1FB733E8D6CED2A105090CEE71DDC0E9FAF3AF6DBA43F17D2E00F5255E2B2FBD209F867A1291
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............H.......bKGD..............pHYs...D...D...%.....tIME........)k...tIDATx..{x.U...U}IwB:.Iw.F ...`...P..../..#.xA...../(...".....0.....<..:..w.G.G..../,..(.-.N...A#.O.........?..>U....|...|.L.`.......h...[.e.`.D&..-...g+Pg...d..I..3.4..p.....T.>.M....+. .O.iF...E.R).F.&..o..K..4.i.`..Y&^.V^Z.UY..T.^fW#..IM.../.U.(.=......b.U.\We.A%.SL...k,.Z......../..0..:.F...F....m....%eT.m'...*..r.]{..j%.....F.3.T.E...'.!.s;n<.d..R....p..+.....ux}u9ng.g..ge..&>..I4LW.L..9X'j.4.C..v..-...].6r..+.0..[..G+"2N.C..Ia.GD......J.<"j...Bl.._....B..a.AdX.M&..j."\.;......)Q..Ua..".^.Mb.7..5.]X.G.Q.z..........x.X..Rc:.5.......G"...6....xF....x;.n..U....A../....f...+} .q..GuU.Zfd.....4=....X$...W`.._:...4|...b..x..X..zQ..S|.dkd...?......ez,.c,p}.Fg...k.!......M.......}.U.j.LH...........%...U.R.1A.rq&.9.....HUUn.1..\9....b.^..2 .0....6.Y-92.}....VQ..HCU>.=.JQ.Cr..;....3W4M..;.\...G*p...3U4MW....q...=Iz...Y}...0.m.6=..q.....?I2..h7hM....6.D&.>e....

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\gui\icons\zoom.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):11786
                                                                                                                                                                                                                      Entropy (8bit):7.957478228690459
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:aekmXwVxRBdZ35KCHx2y4g4574thRlIUqh+4Nrv7YDOXOXxlbveDvfw2l:+bbdZ31HgPt574/RW5J7KOCzzivtl
                                                                                                                                                                                                                      MD5:A93A6C2050830B2AED471A666DD5F52B
                                                                                                                                                                                                                      SHA1:34DE9BB7EDA8B291820622089D5B4DDD3B8ED70A
                                                                                                                                                                                                                      SHA-256:19E15596D401E2D0DC227F5DA3B04179555E449B1C6D7732514B336589D4D713
                                                                                                                                                                                                                      SHA-512:91C96AAD3F90A786F60F3B3C323297BD0E7341ECB0AA47CC85E5E015DF3112CE97EDE28D74FB33D25854782918FAE1D3692B06BE6E07C5352D62BB3951198A2E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............>a...-.IDATx..]..SU...i...L.Q.20.^.E.ba.\u]u].-...ZVEWT.E....b[...DAPA.4.......{.L.....L..^&.e.9x.....w.{.=.^.zH..XK`-.."XS.\[kl...._u..#.p..t.R......k...)u..gl.Y...].......,..6...\Q#. |..W......]n..6.......B`X..*.\u........k....tg.$...-b.....K...Y{..1g.a.&.q...App0.....S.....6-.r...FMu...N......9....x......T...aD.q.....rr..Ov?.e-5-.j..1Y!j.<.......8..?....;w...m?.sN...GY;~........B...]]..<n.$..;......f;.........n...W....G..j.......v).`&kKY..wQ@@ .N..W....$Y.z....5w7.)YsS...(.....j0.....=...r .o/>\..|..'hnn._......xh...h...wQ4..7...L..Jx.Tf.(.1J%T^..Vy..........?..^.A...6.........._}....]}....q........?....$2.n...&N..www.Q...1.W...7...<?..t $.V.....V,7.....e.......3..A...n.Z..........a!....F....nn..q..?|......A.....&;.).L.n........ .CI.1j,...}...7.4b|p.?g.....Jk;......{.c..r..P..~....D.DC..&...F..........;3.4A.....v..$..R..2......-x.4x......v.'bK.|.gI...G.....S..i....1.pv...U.....i.....]...q...xT.<.-...3 ..`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\lnwire\onion_wire.csv

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3121
                                                                                                                                                                                                                      Entropy (8bit):4.799864332727764
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:IzHLC9LgLZWLCALhG0Lro6euCNAQhqQWLeL9Lm:8eO2GWjNx
                                                                                                                                                                                                                      MD5:E384DCF371DF1E40CE76874151812EDD
                                                                                                                                                                                                                      SHA1:434042DC2F8ED57D203BF1B950091636A84EB37D
                                                                                                                                                                                                                      SHA-256:2DDBC1FF1B9EC2E7D2E86E50147A3E61EE569D53E8E097633A61A7E18A9CDFA4
                                                                                                                                                                                                                      SHA-512:DA43A8CAC8020AE237E0E3D9B6B91594E9C962F2F4FD05AFB92F242BC00C265A0D0798010F72985CFEC57962146E1C5D02BE59D7B944386617C5140AFC3B1E51
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:tlvtype,payload,amt_to_forward,2.tlvdata,payload,amt_to_forward,amt_to_forward,tu64,.tlvtype,payload,outgoing_cltv_value,4.tlvdata,payload,outgoing_cltv_value,outgoing_cltv_value,tu32,.tlvtype,payload,short_channel_id,6.tlvdata,payload,short_channel_id,short_channel_id,short_channel_id,.tlvtype,payload,payment_data,8.tlvdata,payload,payment_data,payment_secret,byte,32.tlvdata,payload,payment_data,total_msat,tu64,.tlvtype,payload,payment_metadata,16.tlvdata,payload,payment_metadata,payment_metadata,byte,....tlvtype,payload,invoice_features,66097.tlvdata,payload,invoice_features,invoice_features,u64,.tlvtype,payload,outgoing_node_id,66098.tlvdata,payload,outgoing_node_id,outgoing_node_id,byte,33.tlvtype,payload,invoice_routing_info,66099.tlvdata,payload,invoice_routing_info,invoice_routing_info,byte,....tlvtype,payload,trampoline_onion_packet,66100.tlvdata,payload,trampoline_onion_packet,version,byte,1.tlvdata,payload,trampoline_onion_packet,public_key,byte,33.tlvdata,payload,trampoline_

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\lnwire\peer_wire.csv

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):10291
                                                                                                                                                                                                                      Entropy (8bit):4.483106197219259
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:IYxDifBpiEumGFA0OpJLGYYcRwaiGxyz47omSaIuGcByWyb3t:dVEHLGYj7lbIuxByWyb3t
                                                                                                                                                                                                                      MD5:56A2D1E3978C5FA6512CD9A4AEE94E4E
                                                                                                                                                                                                                      SHA1:E5343179EF2B850AD95956A1723B7191B4E800A3
                                                                                                                                                                                                                      SHA-256:8BF80CAB57F38296474611AF11C116B34A93AECF8575F0164A9E886B335D2422
                                                                                                                                                                                                                      SHA-512:7B3DDA9E17D6E1ADE902D807A17244FE4540063DFCBC12E65FECB183D9B9462812B18C0D73DC9926E00BCFD5D8342D7C588725D94ABB7425A98587DADDF88828
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:msgtype,init,16.msgdata,init,gflen,u16,.msgdata,init,globalfeatures,byte,gflen.msgdata,init,flen,u16,.msgdata,init,features,byte,flen.msgdata,init,tlvs,init_tlvs,.tlvtype,init_tlvs,networks,1.tlvdata,init_tlvs,networks,chains,chain_hash,....tlvtype,init_tlvs,remote_addr,3.tlvdata,init_tlvs,remote_addr,data,byte,....msgtype,error,17.msgdata,error,channel_id,channel_id,.msgdata,error,len,u16,.msgdata,error,data,byte,len.msgtype,warning,1.msgdata,warning,channel_id,channel_id,.msgdata,warning,len,u16,.msgdata,warning,data,byte,len.msgtype,ping,18.msgdata,ping,num_pong_bytes,u16,.msgdata,ping,byteslen,u16,.msgdata,ping,ignored,byte,byteslen.msgtype,pong,19.msgdata,pong,byteslen,u16,.msgdata,pong,ignored,byte,byteslen.tlvtype,n1,tlv1,1.tlvdata,n1,tlv1,amount_msat,tu64,.tlvtype,n1,tlv2,2.tlvdata,n1,tlv2,scid,short_channel_id,.tlvtype,n1,tlv3,3.tlvdata,n1,tlv3,node_id,point,.tlvdata,n1,tlv3,amount_msat_1,u64,.tlvdata,n1,tlv3,amount_msat_2,u64,.tlvtype,n1,tlv4,254.tlvdata,n1,tlv4,cltv_delta,u1

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\ar_SA\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 472 messages, Project-Id-Version: electrum ' (\331\204\330\247 \331\212\331\210\330\254\330\257 \330\263\330\271\330\261 \330\265\330\261\331\201)'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):40537
                                                                                                                                                                                                                      Entropy (8bit):5.395729339687795
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:yvaWN96uLolaBUxJYFa570J0I6DvUto4B8m+pSnaLQ++aXROvP0gkh75bjpLmZHv:yR96uLTjwVtm+dE+nOXWh75pLmi7KUOj
                                                                                                                                                                                                                      MD5:0FBBB97471034E4EB7D5EA5CAEBD1C30
                                                                                                                                                                                                                      SHA1:471AD76AAD72935384B60536B189076C3B84E827
                                                                                                                                                                                                                      SHA-256:1CC1B009FBC1C77EDB8892ED6D1673A7D642E4AC589DF2DF2F3068FA04BC2466
                                                                                                                                                                                                                      SHA-512:6DF2DBD9EB36C4B7E102E5E1F2CA0A25F4EB15555D7A31B8D81E48084296EA12808F83049115959D73DF8F21D62F937CB5632B8D2497AC93B55878B3CC4BCF2C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:....................w...........x'......y'.......'.......'.......'.......'.......'.......'.......'.......'.......'.......(.......(......#(......6(......D(......O(......Z(......o(......u(......}(.......(.......(.......(.......(.......(.......(.......(.......(.......(.......(.......(.......).......).......)......')......4)......:)......O)......X)......_)......f)......l)......t).......).......).......)..:....).......)..K....)..0...+*..m...\*..#....*..=....*..)...,+......V+......e+..0....+..4....+.......+.......,.......-.......-.......-.......-.......-..'....-..8...........=.......Q...-...a......................................................../......./......1/......Q/......m/......./......./......./......./......./......./......./......./.......0.......0......%0......20......D0......V0......\0..O...c0..!....0.......0.......0.......0.......0..(....1......61......A1......F1......W1......_1......y1.......1.......1.......1.......1.......1......v2..c....2.......2.......2.......3.......3......

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\az_AZ\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 771 messages, Project-Id-Version: electrum '(FX m\311\231z\311\231nn\311\231si \311\231l\303\247atmazd\304\261r)'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):58386
                                                                                                                                                                                                                      Entropy (8bit):5.435916754639285
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:Pq4UY3w+Z/QrekGtxmDeceC9zmp+JrsrOIYncNr:Pq4UO/QrefmDedCeyVIYcNr
                                                                                                                                                                                                                      MD5:E38E198A660C08A11BD2CBC56B222CA7
                                                                                                                                                                                                                      SHA1:2AE9B3BF3345CA6D54A4B7ED6A24D43AA65FF848
                                                                                                                                                                                                                      SHA-256:AA24AA5397BBD4F24468E3CD2D99F12BB1B59C9C2BCF8DD336F8019233DC1BC9
                                                                                                                                                                                                                      SHA-512:07191CBD3D6EC3E644456B5E63119FB3DEE6B1E6816D0A8D616ABEABA83AD8C20B679540DCDA3CB300086316B60D7A2AB57B825C292D50560D98EC4697C3B6F5
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:................4.......L0......h@......i@.......@.......@.......@.......@.......@.......@.......@.......@.......@.......A.......A.......A......&A......4A......?A......JA......_A......eA......mA......zA.......A.......A.......A.......A.......A.......A.......A.......A.......A.......A.......A.......B.......B.......B.......B......7B......>B......DB......LB......]B......cB......jB..:...qB.......B..K....B..m....C..#...qC..N....C..=....C..)..."D......LD......[D..0...zD..4....D..>....D.......E......5E......DE......WE......oE......{E.......E..'....E..8....E..&....E......%F.."...4F......WF..-...gF.......F.......F.......F.......F.......F.......F.......F.......G.......G......EG......eG.. ....G.......G.......G.......G.......G.......G.......G.......G..0....G......,H......@H......SH..K...aH.......H.......H..)....H.......H.......I......&I......3I......EI......TI......sI..,....I.......I.......I.......I.......I..O....I..2...(J..!...[J......}J.......J.......J.......J.......J.......J..(....J.......K......

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\be_BY\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 94 messages, Project-Id-Version: electrum ' (\320\232\321\203\321\200\321\201\321\213 \320\262\320\260\320\273\321\216\321\202 \320\275\320\265\320\264\320\260\321\201\321\202\321\203\320\277\320\275\321\213\321\217)'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):8300
                                                                                                                                                                                                                      Entropy (8bit):5.515934098942605
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:czHxONP5G8PwCW/+lJqnfPshprkvk3n1z8/kZ5:czH24alJBucZBZ5
                                                                                                                                                                                                                      MD5:D53973DE6996C9283D0BDC8299FB16B1
                                                                                                                                                                                                                      SHA1:1F4ACA2F61B210769EA36D7304158728F912AD61
                                                                                                                                                                                                                      SHA-256:F102E8CA3A4322D389DB6EA41E1AB5D1997971B21364ED9C98560D5823D8DC83
                                                                                                                                                                                                                      SHA-512:6DDCB856E6EFE85CAB51E7B30560B0FFB171A872D463F4BEA399C58E8CFDA07D9BFD1046BBF5349199C0A81E99D82826C8D44481697A7EDD4477305AD5E1B736
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:........^............................................... .......'.......2.......A.......T.......[.......j.......|.......................................................................................................$.......-.......:.......L.......R.......\.......i.......o.......x...........................................................................................................................:...........T...K..._...m.......#.......=...=...)...{...............................v.......................!...'...3...8...[...........-...................................................+.......5.......J.......S.......W...7...j...............................................................3.......J......._.......v...........................!....... ...........+.......D.......P...0...........".......<.......U.......c...;...r...................D.......I...........g.......w...................................!.......................................(...,.......U..."...a...!...................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\bg_BG\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 483 messages, Project-Id-Version: electrum ' (\320\235\321\217\320\274\320\260 \320\275\320\260\320\273\320\270\321\207\320\265\320\275 \320\272\321\203\321\200\321\201 \320\267\320\260 \320\276\320\261\320\274\321\217\320\275\320\260)'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):41308
                                                                                                                                                                                                                      Entropy (8bit):5.357994937880059
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:CCiDl5yRR7ecH7JNVw+slsjKmiy+jB+t4YE94i456m:CCoZcH73Vw+slsjKmt+Et09455N
                                                                                                                                                                                                                      MD5:477D41B806C893F80ACBAF54BEB3BB47
                                                                                                                                                                                                                      SHA1:AC99C8A6CE1DB035743E6B661898B9A967810A13
                                                                                                                                                                                                                      SHA-256:30BE14096484687E3D37979524E536770F2E666C9A66FCEA38448AF5F9739508
                                                                                                                                                                                                                      SHA-512:15BABF960C0CA87B7A588E8DAE2B5F949A8530FFD928009C4F31EF7A9430A2A684D3453A65060EAB014A62C3B6688C92C704A4DA86576D9577B6296A6922810E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:................4.......L.......h(......i(.......(.......(.......(.......(.......(.......(.......(.......(.......(.......).......).......)......&)......4)......?)......J)......_)......e)......m)......z).......).......).......).......).......).......).......).......).......).......).......).......*.......*.......*......$*......9*......B*......I*......P*......V*......^*......d*......k*..:...r*.......*..=....*..)....*...... +....../+.......+..0....+.......+.......,.......,.......,......6,......F,......X,......p,.......,.......,.......,.......,.......,.......-.......-......(-......1-......5-......<-......M-......Z-......l-......~-.......-.......-.......-..2....-.......-.......-.......-.......-......................%......./.......I...................c..........._/......j/......q/......{/......./......./......./......./......./......./......./......./.......0.......0......,0../...=0......m0..!...{0.......0.......0.......0.......0.......0.......0.......0.. ....1......(1......;1......O1......

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\bn_BD\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 1 message, Project-Id-Version: electrum
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):592
                                                                                                                                                                                                                      Entropy (8bit):5.269102830224006
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:i4SxjCt0d7/4GoMXmBQWivXmBQWii3bb43ZPqzJkTj8bpX:RojCt0dTCMXmQXmHn699jA5
                                                                                                                                                                                                                      MD5:816C288F6B0E7DC4AA426A435A89BC07
                                                                                                                                                                                                                      SHA1:EB51D964A00D033ACFCE454EF2C018E0640713AC
                                                                                                                                                                                                                      SHA-256:7A4CDECD83982AEFCF7FF9789BF264A283FEA92B36D56293E2E2AFDECD4574E0
                                                                                                                                                                                                                      SHA-512:043DA9FF54963C7A281862E2803D6B900DA5231033013A63E01968F77E7C5DA37D752DC054E5DE3CC3FA907FCD1F877CBA4DC43F9F07ED76EEA8D2A1A4451DFA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:................$.......,.......8.......9................Project-Id-Version: electrum.Report-Msgid-Bugs-To: .PO-Revision-Date: 2024-02-21 17:10.Last-Translator: .Language-Team: Bengali.Language: bn_BD.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.X-Qt-Contexts: true.Plural-Forms: nplurals=2; plural=(n != 1);.X-Crowdin-Project: electrum.X-Crowdin-Project-ID: 20482.X-Crowdin-Language: bn.X-Crowdin-File: /electrum-client/messages.pot.X-Crowdin-File-ID: 68..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\cs_CZ\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 1703 messages, Project-Id-Version: electrum ' (\305\275\303\241dn\303\275 kurz k dispozici)'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):160600
                                                                                                                                                                                                                      Entropy (8bit):5.4663336978427575
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:H8e0ar/kxspdAqVw+slstBfSEUCJEKSE+v7hC65GugutKejj+gO4:D35sP1R5tljRr
                                                                                                                                                                                                                      MD5:D665F1A647D9B37D157F557AA56C2714
                                                                                                                                                                                                                      SHA1:832423E392156D2193B4F62590413C89CD6404D1
                                                                                                                                                                                                                      SHA-256:B3D863F3A743CDF15256BD93E879BD855582BB6510A75CCD0F3DCB0990BE6208
                                                                                                                                                                                                                      SHA-512:95AB76EED0A48303D522ADE25246007BCB12682AF96C651E8F0EE0725C31747ADC2D5DEF21A7071CBF1F214941D4BFB256F5B9E226B6577F7AB0C72E4432A335
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:................T5.......j......................*.......8.......?.......J.......Y.......l.......s...................................................................................................".......*.......<.......E.......R......._.......q.......w...................................................................................................................................*.......0.......7...:...>.......y...K.......0......m.......#...o...........N...d...=.......)..................*...0...I...4...z...............R..............^.......t...0....................................'.......8.......&...U...*...|...................3......"...........!...-...1......._.......g.......w............................................................../.......F.......\.......x............................................................*.......>...R...G..........."......................0......................7.......O...f...........K..................+...)...2.......\.......

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\da_DK\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 361 messages, Project-Id-Version: electrum ' bekr\303\246ftelse'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):23970
                                                                                                                                                                                                                      Entropy (8bit):5.116579575944753
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384://vvigy+uhCtZA6obFx0undlSum81W/S+TuRZLpoHhUBQpW8jD6:f6gy+ucvAjz3mtK+GWH++D6
                                                                                                                                                                                                                      MD5:D84D899D6333DBD2B8A500CA7207199D
                                                                                                                                                                                                                      SHA1:BE1FBE44B07CB4AA25452114A4F20F298E34771F
                                                                                                                                                                                                                      SHA-256:E3A2199DE376F5C031AAFBDBD8E145F165A30E20ACA49006801F4164A8EB743D
                                                                                                                                                                                                                      SHA-512:1C19200DE7C44DB252673B37B82D0A0FC9F4A7759BBC58807635AFAC0340FBAE41A509979B77502F7B698612522483C20D069C40B1DEC4B063E2C9363AAAFA35
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:........i.......d...............H.......I.......W.......^.......i.......|....................................................................................................... .......2.......;.......H.......Z.......`.......j.......w.......}................................................................................................................ ..).... ......3 ....... ....... ....... ....... ....... .......!.......!......7!......N!......j!.......!.......!.......!.......!.......!.......!.......!.......!......."......."......."......."......$"......<"......F"......`"..c...x".......".......".......".......#.......#.......#..O....#......m#......s#......y#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......#.......$.......$.......$.......$../...)$......Y$......a$......r$..f....$.......$..G....$..1...F%..-...x%..4....%..4....%..K....&......\&......d&......l&.......&.......&.......&.......&.......&.......&.......&.......&.......'.......'......

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\de_DE\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 2428 messages, Project-Id-Version: electrum ' (Wechselkurs nicht verf\303\274gbar)'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):242965
                                                                                                                                                                                                                      Entropy (8bit):5.290328157274503
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:osEDWlj1okktGcHVw+slsSciMKsLFvTTK7gMV2YE+/D8ULAC+kA+QpK/A7ZwV/hf:osErkks36LIDaFkWK/syShFuHym
                                                                                                                                                                                                                      MD5:DB86A7DC1E6524A2BFF18588A0D740C3
                                                                                                                                                                                                                      SHA1:E0AAE8F805D5311F23BE7F647BAA4058B68D1829
                                                                                                                                                                                                                      SHA-256:47639C1FA4469484309248F197445524A5BF078DBD81202770E604174C44C74D
                                                                                                                                                                                                                      SHA-512:C27072D2EB216580BF430435D915945706607D62127AA2C92FF194D292EDA3562CBA863A3268230995EE2243E2296E4F93D7B82F17F156E87C55B55E9A31E860
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:........|........K.............................................................................................,.......E.......M.......S.......f.......t....................................................................................................................... .......-.......3.......<.......J.......P......._.......k.......x.......~................................................................... ...............$.......%...C.......i.......x.......~...........:...............K.......0.......m...O...#...............N.......=.......)...?.......i.......x...0.......4...........................)...L.......>...........8.......N...0...`...................................................................................'...>...8...f...,.......'.......&.......+.......*...G.......r...........3......."...............-...........*.......2.......B.......T.......k...................................................M...........c.......{.......................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\el_GR\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 283 messages, Project-Id-Version: electrum '&\316\240\316\265\317\201\316\257'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):26844
                                                                                                                                                                                                                      Entropy (8bit):5.416806619781651
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:nzQwR9S0umfc+ikDaC5eEdw2rOnTodqiaTN1/y:7S0um0+v2C5eEOyOnTodqDTN1/y
                                                                                                                                                                                                                      MD5:C5743C1AA7FA3F9FD77E1DD6212E21C3
                                                                                                                                                                                                                      SHA1:4F6820746FD243BFAE4CE6AD9B1461904005905F
                                                                                                                                                                                                                      SHA-256:C91A316F5345EDFAE9388A3A33B23C85102D7928B343A8B7234D25EDDFAB83C9
                                                                                                                                                                                                                      SHA-512:371973EF4C33DD4AEC8F4ADFC9075BF049159773ADB8C29FC63EE0FD409774D87E16F3D386F9F03E73FB4F45444DAB4E29E7BE1C69848B0E4D81FEE5906FCE85
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:....................{.........................................................................................../.......5.......=.......E.......W.......`.......m...........................................................................................................................)...........4.......................................................7.......R.......Y.......j.......w...................................c...........7.......B.......L.......].......a...O...h.................................................................................../...........I.......Q.......b...f...w...G.......1...&...-...X...4.......4...........................................).......<.......B.......Y.......p.......x...........................@...........................................!.......(.......-.......F...`...N...................!.......!.......R.... ......a ......m ....... ....... ....... ....... ....... ....... ....... .......!.......!....../!......8!..3...I!......}!.......!.......!......

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\eo_UY\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 60 messages, Project-Id-Version: electrum '&Pri'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3829
                                                                                                                                                                                                                      Entropy (8bit):5.048260007584128
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:fyZTUdhzeww6wfHeEdb/C59pZwsNKvIpUIsKebV6epBjPdJvxa9djQfq+8x2NEaN:fSYLzGeEK9Tw5vms+erLHxAJT2N3+WF
                                                                                                                                                                                                                      MD5:28588BE47CFA72C6DD85EB87CD9C8FBE
                                                                                                                                                                                                                      SHA1:645EB66567806383A00BB8D2379F5C7F9DD94BDF
                                                                                                                                                                                                                      SHA-256:CD1848AB854D8BD48359727D9108DC0A60FB4295E4C8615EF1823F7218646666
                                                                                                                                                                                                                      SHA-512:92C1C5F3A74F1ED9447289F94D13E0AF7E6D1C3FF1C1DA57E51211C4AB215B032E7BD28BFA099F9B8D19301B7C0F2A33DDFC9D06EB783A58CDCDD66DDF534857
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:........<...........S...........(.......).......0.......?.......E.......K.......Q.......X......._............................... .......7.......>.......F...c...^.................................................................../...........7.......?.......G......._.......i.......o..................................................."...........:.......Q.......k...............................................................6.......T... ...g...............................................................................4.......9.......F.......O.......V.......].......d.......n....................................... .......%.......-...h...5...................................................................&...................................%...............4.......:.......?.......F.......P.......W.......\.......a.......k.......q.......v.......|...................................................................................................................................................4...

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\es_ES\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 2387 messages, Project-Id-Version: electrum ' (No hay tasa de cambio disponible)'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):234913
                                                                                                                                                                                                                      Entropy (8bit):5.217998001938283
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:fe3o4o/84nS11GcPVw+slsS4v/3sLFvDRK7giV2YE+eD8ULAC+kAAQvYzEWtcimE:feA1nS1kiUdVDaFkmM/tcimf33c
                                                                                                                                                                                                                      MD5:E1FEDB340A9536382723F7AC1965047F
                                                                                                                                                                                                                      SHA1:2163E45CCA50BA11D03CCFCE687E5FC85664CD2E
                                                                                                                                                                                                                      SHA-256:F292ACA5C9BBAF41D3037EDA53DD93A2443B626F6B6DA31A9EFD53F0E6803AAD
                                                                                                                                                                                                                      SHA-512:EDD837356059145AE11EEFBA2CD2E39A307F539F07B21CCBBF1A9A9531B374947872CEC9341789929921A519B16F296B7956DF4C0F724795A0A78D7A03413B30
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:........S........J..s...L.......................2.......@.......G.......R.......a.......t.......{.......................................................................................................*.......2.......D.......M.......Z.......g.......n....................................................................................................................................... .......(.......9... ...I.......j...$.......%.......................................:...........)...K...4...0.......m.......#...........C...N.......=...c...).......................0.......4...*......._...................L.......>...[...................0...................................%.......=.......Q.......c.......r.......~...........'.......8.......,.......'.......&...V...+...}...*.......................3......."...+.......N...-...^.......................................................................+.......?.......W...M...w.......................................3.......J.......`.......|...............

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\fa_IR\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 358 messages, Project-Id-Version: electrum '\331\205\330\252\331\206'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):32688
                                                                                                                                                                                                                      Entropy (8bit):5.457262354130548
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:/DQR5s0XLPmqq54ZgbJnmC/YQZMYfUpOL1/KCd:/DQR53XouZmJnUQGYfUpO4Cd
                                                                                                                                                                                                                      MD5:D7058AF0F160ABA4CC5DD6878AFAEB86
                                                                                                                                                                                                                      SHA1:B0CA4614AA752C10F28AD7A9423810058B7044C1
                                                                                                                                                                                                                      SHA-256:50C7395FC184E3D8F1A8C06D823FFB70D2C6BBCA891505BA691D794FC1DF14CA
                                                                                                                                                                                                                      SHA-512:E552AA4B3EFF9EBD6793361186CE174926775191E7107515F76F62621413314D15E059F5F22F106C40BF56D0838E194FD1C3A9CE16C03EE40FD33A37D4DCCF3F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:........f.......L.......|............................... .......'.......2.......E.......L.......[.......m.......................................................................................................................*.......0.......:.......G.......M.......V.......d.......j.......y...................................................................................................:...........2 ..K...= ..m.... ..#.... ..=....!..)...Y!.......!.......!..0....!.......!.......".......#..0...$#......U#......a#..'...s#..8....#.......#..-....#.......$.......$......*$......<$......S$......k$.......$.......$.......$.......$.......$.......$.......$..7....$..O...1%.......%.......%.......%..)....%.......%.......%.......&.......&......'&......F&..;...X&..,....&.......&.......&.......&..O....&..o...,'..2....'..!....'..K....'..1...=(......o(......x(..9....(..8....(.......(.......)...... )..(....)......W)......f)..`...q)..b....)..2...5*......h*......m*......~*.......*.......*.......*.......*......

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\fr_FR\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 1469 messages, Project-Id-Version: electrum ' (Aucun taux FX disponible)'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):140340
                                                                                                                                                                                                                      Entropy (8bit):5.204645956823715
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:c47fDNx/Hac0N9Vw+sls5yAY041E+kO5Cks8yBK5gQQ0PrJ+MTtITk2dUjPFrj:c47XHB0XfGls8yBK5gQQ0oMTtITk2dOZ
                                                                                                                                                                                                                      MD5:AE5BE70743E56FB2D0B6104976DB530F
                                                                                                                                                                                                                      SHA1:31D5D9BD29C4662CD087D874CFD1CB0A0B1AA08C
                                                                                                                                                                                                                      SHA-256:F5A43C1A044F97BB0EB2BACB3568914C6CECF9751F04DAC9D8A9CABBCFF30654
                                                                                                                                                                                                                      SHA-512:CF4C43B8FD2BC241D98C87B845656A8425FE33845A08F533F16DC7778B17E6DC03710B01D97B3EB168DCB825D809779E008B5401856A62AD412F521D75D3ACE4
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.........................[.......z.......z.......z.......z.......z.......z.......{.......{......#{......2{......D{......]{......e{......k{......~{.......{.......{.......{.......{.......{.......{.......{.......{.......{.......{.......|.......|......!|......'|......1|......>|......D|......M|......[|......a|......p|......||.......|.......|.......|.......|.......|.......|.......|.......|.......|.......|.......|..:....|......)}..K...4}..0....}..m....}..#....~......C~..N.......=...c...).......................0.......4...*......._...................>...........M.......c...0...u.........................................................'.......8...E...,...~...&.......+......*...........).......8...3...L..."...............-.........................................".......0.......J.......b.......z.....................................................1.......M.......j.......t..........................................R..........1..."...5.......X.......c...0...m...................7......O...

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\he_IL\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 1272 messages, Project-Id-Version: electrum '(\327\251\327\242\327\250 \327\224\327\236\327\250\327\224 \327\234\327\220 \327\226\327\236\327\231\327\237)'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):128597
                                                                                                                                                                                                                      Entropy (8bit):5.303020443683155
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:hhscXEZTetr6Vw+slsAk4BLffJGf6E8vuvZjVSgiIJU1coGUSKM:hhHBBNGvZjVSgiIJU1coGUSKM
                                                                                                                                                                                                                      MD5:FCA0B11087F2C224871692C98F981729
                                                                                                                                                                                                                      SHA1:E312F6EF204C3DE0ECD3F49F00249B1D8F04D4E8
                                                                                                                                                                                                                      SHA-256:46C45675AD3B8AE12455DB6337680450371910D1627FE63BE00CC7FEF5E9CD9E
                                                                                                                                                                                                                      SHA-512:3348D9FCEC075285EFBEDCC4821D0A340F30FABE3C825DF198A2C27933C1D510C7AE58494987053C90C52F00E1C0CB9BF062E92764EF52631A4E324D0E8B68FC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.................'.......O...... j......!j......:j......Hj......Oj......Zj......mj......|j.......j.......j.......j.......j.......j.......j.......j.......j.......j.......j.......k.......k......#k......,k......9k......Kk......Qk......[k......hk......nk......wk.......k.......k.......k.......k.......k.......k.......k.......k.......k.......k.......k.......k.......k.......l..:....l......Bl..=...Ml..)....l.......l.......l..0....l..4....m......Im.......m......un.......n..0....o......?o......Oo......[o..'...mo..8....o.......o..-....o.......p.......p......$p......6p......Mp......gp.......p.......p.......p.......p.......p.......q.......q......7q......Sq......pq......zq.......q.......q.......q..R....q.......r.......r..7...(r..O...`r.......r.......r.......r..)....r.......s......&s......7s......Ds......Vs......us..;....s..,....s.......s.......s.......t..O....t..o...[t..2....t..!....t..K... u..1...lu.......u.......u..9....u..8....u.......v......:v......Ov..(...]v.......v.......v..`....v..b....w..2...

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\hu_HU\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 2427 messages, Project-Id-Version: electrum ' (ismeretlen \303\241rfolyam)'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):245235
                                                                                                                                                                                                                      Entropy (8bit):5.438858465982928
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:GgcQw7ryXelVVOrs29tGcHVw+slsSciMDsLFvTTK7gMV2YE+/D8ULAC+kA+Qo8xz:cHvorsss3ZLIDaFkz8sySHI
                                                                                                                                                                                                                      MD5:92AAC342E6485AD7FE9BABE8A709DD13
                                                                                                                                                                                                                      SHA1:E6D5FD0BB0ACCDB6F7BCB98D57D4BA2B6E36CF37
                                                                                                                                                                                                                      SHA-256:636604B51988DC230C53E6E0197105791EB89AD3C73BBB3925BCA332B2FA426F
                                                                                                                                                                                                                      SHA-512:0E52867ADB26904ACDB2DBACAC79528E217A5CFB063265D5FAE9509680087B9D4981D14582B06DB00A4F6DF4F8C16000EA38AD337FF9DA19FB1B29BF23601819
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:........{........K.....................................................................................................5.......=.......C.......V.......d.......o.......z.......................................................................................................................#.......,.......:.......@.......O.......[.......h.......n................................................................... ...............$.......%...3.......Y.......h.......n.......u...:...|...........K.......0.......m...?...#...............N.......=.......).../.......Y.......h...0.......4...............................L.......>...........(.......>...0...P...................................................................................'.......8...V...,.......'.......&.......+.......*...7.......b.......q...3......."...............-...................".......2.......D.......[.......u...........................................M...........S.......k.......................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\hy_AM\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 265 messages, Project-Id-Version: electrum '&\325\204\325\241\325\275\325\253\325\266'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):17750
                                                                                                                                                                                                                      Entropy (8bit):5.363025206362588
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:3PQaWrahxO90DSBk0zlzRNlXaKIsQgYCMXra976D4rsxswzJZu6I3wCP8Bmmq8oL:NxO91zdRNsPhRs9m5mwjMwCE6ztQg
                                                                                                                                                                                                                      MD5:EEA69BAFB2118B1B1F2A56EA84D466F2
                                                                                                                                                                                                                      SHA1:DDBE0943FBD56BB6BFA74B493EDBCC82287020B2
                                                                                                                                                                                                                      SHA-256:350954F7D9DB808205CFABD434DD60A3535DE708D65C40D55E06C8298FEE14FA
                                                                                                                                                                                                                      SHA-512:671688A17FB6462B3A8F3016020DE2A0087770D73E4BF1FFB5EB8D8A09F4F5E6241D5AEBCB19AA304EC194DFD67D793E94A26E87F6F582AEFC5D07AB0ACE12E3
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:................d...a...........0.......1.......8.......C.......R.......d.......}.......................................................................................................................$.......1.......:.......H.......N.......].......i.......o...........................................................)...................g.......v............................................................... .......=.......D.......U.......b.......t.......................................................\...c...t...............................................#.......'...............?.......O.......e.......{...F.......O...........A.......K.......Q.......W.......k.......}...............................................................................).......4.......9.......A.......H.......T.......\.......m.......}.......................................................................................&.......=.......K.......S.......[.......b.......q...............................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\id_ID\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 907 messages, Project-Id-Version: electrum ' (Tidak ada FX rate yg tersedia)'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):75349
                                                                                                                                                                                                                      Entropy (8bit):5.129458516006702
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:Tl9a3YAtZHhWpl49XsVw+slsVWRKBiiJF7meE+iidaqdkS2OEnZ84PoPa:TlAYAtZBzsVw+slsVWRFiJFHE+iiQqV0
                                                                                                                                                                                                                      MD5:F64536D9E6867C5AD900F1CBFFFAAB17
                                                                                                                                                                                                                      SHA1:1F7C110BA758B480ED64082304ECFA9707326FA6
                                                                                                                                                                                                                      SHA-256:209DF4BA1957A3201B9092B811512C5B3EC784F96ECF574948391609A51A1E7B
                                                                                                                                                                                                                      SHA-512:911C1DF970AB6D8D6CD879AF264AECFC828C1C212EACF9FCE0CE8337699D8E27119ECBDE7430928C9587B13980DFBFEA35F584CAAD2D7989B414AA158924A46B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:................t........8.......K.......K.......K.......K.......K.......K.......L.......L......#L......2L......DL......]L......eL......kL......~L.......L.......L.......L.......L.......L.......L.......L.......L.......L.......L.......M.......M.......M......$M......1M......7M......@M......NM......TM......cM......oM......|M.......M.......M.......M.......M.......M.......M.......M.......M.......M.......M..:....M.......N..K...'N..0...sN..m....N..#....O......6O..=....P..)...EP......oP......~P..0....P..4....P.......Q.......Q....../R.......R.......R.......R.......R.......R.......S..'....S..8...?S..*...xS.......S..-....S.......S.......S.......S.......T......"T......<T......TT......lT.......T.......T.......T.......T.......T.......U......%U....../U......DU......UU..R...^U.......U.."....U.......U.......U..7....U..O...7V.......V..K....V.......V.......V..)....W......-W......IW......ZW......gW......yW..'....W.......W.......W..;....W..,....X......JX......XX......cX......iX..O...pX..o....X..2...0Y..!...

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\it_IT\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 1503 messages, Project-Id-Version: electrum ' (Nessun tasso FX disponibile)'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):139626
                                                                                                                                                                                                                      Entropy (8bit):5.153636684595811
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:/+lcgejgD6Vw+slsZM4ZD0JsiJE+zEUCkjHzNSWKsSx26EMrM3lji:WlpMxq9ljHzMWOx2uM3lji
                                                                                                                                                                                                                      MD5:B5A190466F567299F07163998E690F04
                                                                                                                                                                                                                      SHA1:2BC9366E50FF506EBD11F040168B706796667BDB
                                                                                                                                                                                                                      SHA-256:5E28FF0590EDB115CDC855162C2585E4834A3AF5BCDC0B2F0D2B50DFDAF1D177
                                                                                                                                                                                                                      SHA-512:8CA5D41D2C3AD4096D95D24FFA8FB4BCB29403BCFF53CBEC4CF3DE15F4D6A5726711174A83E4F819A28B07CCF6300556979173AAB94E1BFCF23F95D634B3A415
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:................./.......^......x}......y}.......}.......}.......}.......}.......}.......}.......}.......}.......}.......~.......~......#~......6~......D~......O~......Z~......o~......u~......}~.......~.......~.......~.......~.......~.......~.......~.......~.......~.......~.......~..............................'.......4.......:.......O.......X......._.......f.......l.......t...........$...............................:...............K.......0...f...m.......#...........)...N.......=...I...).......................0......4...........E..............q..................0...........M.......].......l.......x...'.......8.......*..............-...&.......T.......\.......l.......~.....................................................-.......C......._.......z........................................................R...........p..."...t...................7.......O...........F.......T.......o...)...v.................................'..................3...;...E...,...........................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\ja_JP\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 1628 messages, Project-Id-Version: electrum ' \357\274\210\346\263\225\345\256\232\351\200\232\350\262\250\343\203\254\343\203\274\343\203\210\345\210\251\347\224\250\344\270\215\345\217\257\357\274\211'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):176454
                                                                                                                                                                                                                      Entropy (8bit):5.922955364460137
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:xBy6Vd58Vw+slsEP4YohlJslHE+D7qCx5kDYoXFz+8L6CVI2VvW:WTXAW455o//VVVu
                                                                                                                                                                                                                      MD5:64D788DE8C80AFBF809EA7A30637B5A0
                                                                                                                                                                                                                      SHA1:4127FC0721954EC0FC898C617C9BDDFD73C19EF1
                                                                                                                                                                                                                      SHA-256:905D74419C898A23EA6B249ADDC71C541A1CA5A0A67536156AA382C412C6B214
                                                                                                                                                                                                                      SHA-512:3779F6DD2D82E5C8C9FA60DEFD81C862B8123BF25B13F4F9C3199F69AD89F249EAAF6191055F09C6BBFB28AC41686FA641D59A580970AD34BCDA36FAD793B84D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:........\........2.......e............................................".......1.......D.......K.......Z.......l...................................................................................................................*.......<.......B.......L.......Y......._.......h.......v.......|......................................................................................................:...........D...K...O...0.......m......#...:.......^...=.../...)...m...................0......4...........+..............W..................0...........3.......C.......R.......^...'...p...8.......*..............-...........:.......B.......R.......d.......{.....................................................).......E.......`.......|.................................................R...........V..."...Z.......}...........7.......O..........,...K...:...................).............................................'...-.......U.......t...;.......,.................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\ko_KR\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 861 messages, Project-Id-Version: electrum '\355\231\230\354\234\250 \353\241\234\353\224\251 \354\213\244\355\214\250'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):74055
                                                                                                                                                                                                                      Entropy (8bit):5.9049170342869735
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:ijNZNHYD9d1Ja60ls7cqnVJmTE+F7v8JmoZWF4W4FYJbzAUm:AZNHYDFx0ls7xKE+F7SeHbC
                                                                                                                                                                                                                      MD5:239A92A6EE3EA9BA49327014C9719E8F
                                                                                                                                                                                                                      SHA1:6A4A25F69F55FF3BAE448B6369E39CF9AB8939BF
                                                                                                                                                                                                                      SHA-256:F5069D241FF981C257B462FD0FFE739D3D3888D4A7BC9E0AB9080D812A298597
                                                                                                                                                                                                                      SHA-512:8B3413EA3A72A4102192D80D91B4173B94691C72DACD741A4BCA893BBC33F33DF5CD2901A45200AE0D8AC7299102242C6AECEC3E880F5266FFA18D2300B3C4B3
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:........]................5.......G.......G.......H.......H.......H......"H......1H......DH......KH......ZH......lH.......H.......H.......H.......H.......H.......H.......H.......H.......H.......H.......H.......I.......I.......I......*I......7I......II......OI......YI......fI......lI......uI.......I.......I.......I.......I.......I.......I.......I.......I.......I.......I.......I.......I.. ....J......#J..$...9J..%...^J.......J.......J.......J.......J..:....J.......J..K....J..0...9K..m...jK..#....K.......K..N....L..=....M..)...ZM.......M.......M..0....M..4....M.......N.......N......DO.......O.......O.......O.......O.......P..'....P..8...BP..,...{P..'....R..&....R..+....R..*...#S......NS......]S..3...qS.."....S.......S..-....S.......T.......T.......T......0T......GT......UT......oT.......T.......T.......T.......T.......T.......U......*U......4U......IU......ZU......lU......uU..R....V.......V.."....V.......V.......W..0....W......CW......WW..7...jW..O....W..2....W......%X..K...3X.......X......

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\ky_KG\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 146 messages, Project-Id-Version: electrum 'Electrum &\321\202\321\203\321\203\321\200\320\260\320\273\321\203\321\203'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):8631
                                                                                                                                                                                                                      Entropy (8bit):5.401732780892745
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:IHpljx5rtqkI8OHDLsxsAdzaP6y6xSmQXXJE:IHpSr38mAduKxSa
                                                                                                                                                                                                                      MD5:7327F1C9A4E89AA8309811353551C786
                                                                                                                                                                                                                      SHA1:281BFCA8DE5F4B86E57775F3F974EEC3B814B1E2
                                                                                                                                                                                                                      SHA-256:F7E50213F4C7B8EA2849A39A16BFE08E5E13C3A7407D78AB5D96BD3D7A8D1FAD
                                                                                                                                                                                                                      SHA-512:582BF3744ED137AE13B21C93A37D83A5A8C1158AF354595FBC15715FB0E3407716BFB5064B569DEFD2291258FF143BC1CBA42F0997D344C3F7EAC6E28DCFFCF5
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:........................<.......P.......Q.......X.......g.......o.......u...............................................................................................................................................0.......H......._.......{.......................................................................................................................-.......2.......9.......E.......T.......Z.......q...........................................!.......!...........................).......@.......[.......o..........................."................................... .......7.......?.......X.......p...............................................................................&.......2.......H.......a.......m.......................................................................7.......>.......M.......j...........................................................................)...........<.......Q.......k.......t... ...~... ...........................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\lv_LV\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 1206 messages, Project-Id-Version: electrum ' (val\305\253tas kurss nav pieejams)'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):100263
                                                                                                                                                                                                                      Entropy (8bit):5.347808505414221
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:a8UrUgMAjJ3Fj+2GN4EVE+M/E6u0B2n0S8J/IcH3vb:alUgMS3MZM/E6u0QnTOV3T
                                                                                                                                                                                                                      MD5:4E8F6BA76E930BAD6F88B4CDA57A5A66
                                                                                                                                                                                                                      SHA1:CF048B2BD9428E0B82A190A41F5A351D86021011
                                                                                                                                                                                                                      SHA-256:695EBB665FC170A2B512B6D2F080D51F7E92FF9747CD0ED77B6153201A932CB1
                                                                                                                                                                                                                      SHA-512:FFC1B9669F6C7F2968F0BC69C2174213217E4A98937BB3458CC3608502943DBB9F06C3040D38F5854D96833487BD40A21B679CA071C4ECA8F54A45209C283C33
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.................%..I...|K.......d.......d.......d.......d.......d.......d.......d.......d.......e.......e......$e......=e......Ee......Ke......Ye......de......oe.......e.......e.......e.......e.......e.......e.......e.......e.......e.......e.......e.......e.......f.......f.......f......(f.......f......=f......If......Vf......\f......qf......zf.......f.......f.......f.......f.......f.......f.......f..N....f..)....g.......g......=g.......g..0....g.......h.......h......,h..'...>h..8...fh..*....h.......h.......h.......h..-....h......+i......3i......Ci......Ui......li.......i.......i.......i.......i.......i.......j.......j......7j......Sj......oj.......j.......j.......j.......j.......j.......j.......j.......j..7....k..O...=k.......k.......k.......k.......k.......k.......k..'....k.......l......6l......Hl......Vl......al..o...hl..K....l..1...$m......Vm......_m..9...sm..8....m..(....m.......n..`....n..b...{n.......n.......n.......n.......o.......o.......o......)o......1o......Mo......fo......

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\nb_NO\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 526 messages, Project-Id-Version: electrum '%d bekreftelse'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):38311
                                                                                                                                                                                                                      Entropy (8bit):5.1245242445350385
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:jyH3XOwuGjB2ixN0Vw+slsU1VUmb5+xz6wuXEjI0OBnR5cEAHRiNob:jyBl7xN0Vw+slsU1VUmt+F3OAHR9b
                                                                                                                                                                                                                      MD5:4977113D81C3FCCA7E9A83CF52FAD981
                                                                                                                                                                                                                      SHA1:335AA01402176B6A89596301B22F44E8A1C3259B
                                                                                                                                                                                                                      SHA-256:B4176EEB84D1EC84E7B30307B1C28840132D3BEC75ECB5F02684036273DCAD62
                                                                                                                                                                                                                      SHA-512:55DB790BE7FC0065C0EAAE950DD9B48D45C3D628861045F07FEFFF1B247B7BF093E6D4E5D4AD1D32D17362B0AEBA85FC4800FE272AE1853E7C72620022EC8B7C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:......................... .......+.......+.......+.......,.......,.......,......6,......<,......J,......U,......`,......u,......{,.......,.......,.......,.......,.......,.......,.......,.......,.......,.......,.......,.......,.......-.......-......&-......--......4-......<-......B-......I-..:...P-.......-..=....-..)....-.......-..0...........>...............j/......./......./......./..-..../......./......./......./.......0.......0......20......J0......a0......}0.......0.......0.......0.......0.......0.......0.......0..K....1......\1......w1..)...~1.......1.......1..'....1.......1.......2..;....2..,...[2.......2.......2.......2.......2..O....2..o....2..2...n3..!....3..K....3..1....4......A4......J4..9...^4..8....4.......4.......4.......4..(....5......)5......85..`...C5..b....5.......6......!6......06......<6......I6......V6......[6......l6.......6.......6.......6.......6.......6.......6.......6.......7.......7.......7.......7.......7.......7.......7..c....7......V8......c8......n8......

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\nl_NL\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 2421 messages, Project-Id-Version: electrum ' (Geen FX-tarief beschikbaar)'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):233572
                                                                                                                                                                                                                      Entropy (8bit):5.198990584379234
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:/JJQKMkkY4VVGcHVw+slsScDMOsLFvgTK7gMV2YE+ND8ULAC+kA+QY0jycOJvaXE:qkk9VEQcqUDaFkHUynvanq6yom
                                                                                                                                                                                                                      MD5:CA4F330F42D196776DE2A06311204643
                                                                                                                                                                                                                      SHA1:AD8982E8914F09F2FB3B1FB2FC254DAE3A30B22F
                                                                                                                                                                                                                      SHA-256:DE88C222DA8D47C832F375EB3D048BDAE87BBA70C7F6356D2B8A793349B53306
                                                                                                                                                                                                                      SHA-512:A703092459EC4778C09C4A223812CB2462B025B1E155071463EDB2677C74896F145464C2F9F290EA69765D2306C56645D4714D47B09AE36AE8E7F7B955DBD9B2
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:........u........K......l.......................................................).......<.......C.......R.......d.......}..............................................................................................................."......./.......6.......H.......N.......X.......e.......k.......t................................................................................................................... ...........@...$...V...%...{...................................:...............K.......0...V...m.......#...............N.......=...9...)...w...................0.......4...........5...............a...L.......>...1.......p...........0...................................................'.......9.......H.......T.......f...'...v...8.......,.......'.......&...,...+...S...*.......................3......."...........$...-...4.......b.......j.......z...............................................................-...M...M............................................... .......6.......R.......

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\pl_PL\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 733 messages, Project-Id-Version: electrum ' (Kursy waluty niedost\304\231pne)'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):57433
                                                                                                                                                                                                                      Entropy (8bit):5.324894261124312
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:WKn93yEbdbi1QFXM6fy+Vw+slsvbWhYmO9E+p5qUxgyEgtYMuNmZwEHbUpkQfTrQ:7bdUoU+Vw+slszWhYmkE+p/qyAUwv5vQ
                                                                                                                                                                                                                      MD5:4239BF82AFF38BB62099AD01F75E062B
                                                                                                                                                                                                                      SHA1:F148AF52D0939D211AB810480408F09A9AEE4E1D
                                                                                                                                                                                                                      SHA-256:4DD1498D0A98BC5BABC66AA181D90AAEEFFCCCB977B47D812AFA84D88B2D508B
                                                                                                                                                                                                                      SHA-512:C3725FE851A4B040B730C37F611F8C9161481AE4075DEA282E50E082CFAF4C28F96C71DB301DF23C21B0FB03CD7FF70903984D41A8BC45831A2C9D8CC22832B7
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.........................-......0=......1=......J=......X=......_=......j=......}=.......=.......=.......=.......=.......=.......=.......=.......=.......=.......>.......>.......>...... >......(>......:>......C>......P>......b>......h>......r>.......>.......>.......>.......>.......>.......>.......>.......>.......>.......>.......>.......>.......>.......?.......?.......?......!?......(?..:.../?......j?..K...u?..m....?..#.../@..=...S@..)....@.......@.......@.......@.......A.......B......+B..0...=B......nB......~B.......B.......B..'....B..8....B.......C..-....C......JC......RC......bC......tC.......C.......C.......C.......C.......C.......D......%D......BD......LD......aD......sD......|D.......D..7....D..O....D.......E......)E......DE..)...KE......uE.......E.......E.......E..;....E..,....E...... F.......F......4F..O...;F..o....F..2....F..!....G..K...PG..1....G.......G.......G..9....G..8...%H......^H......jH.......H..(....H.......H.......H..`....H..b...1I.......I.......I.......I.......I......

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\pt_BR\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 2236 messages, Project-Id-Version: electrum ' (Sem a taxa FX dispon\303\255vel)'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):214654
                                                                                                                                                                                                                      Entropy (8bit):5.253736154099641
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:XEjx1N32j4nnXev2cVVw+slsCJAD5sLJ9UKSV2YE+1FS2CKk4AQYCvMEbMW4JXlk:XKx18je02AScFDHkYMOvxb
                                                                                                                                                                                                                      MD5:36E88B2B51B23FACA27C08777E5324D5
                                                                                                                                                                                                                      SHA1:04F7CCD6F79FB78D76600CE17E96743B83CCA121
                                                                                                                                                                                                                      SHA-256:F638A4AAF5CC1A80D084CDADCC0785D8DE023A335C91895258706970F7A6D014
                                                                                                                                                                                                                      SHA-512:6585346CCCC4D1096CE15FCCC99760E9501A01264DD8B809FF5820D33E67D1E4F06669DE267C176F209A33A753E04EDF52AA66EB68684770BB53CBDBC0392E5D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.................E.................................................................................*.......<.......U.......].......c.......v........................................................................................................... .......&.......0.......=.......C.......L.......Z.......`.......o.......{......................................................................... ..............$... ...%...E.......k.......z...................:..............K......0... ...m...Q...#..............N.......=.......)...A.......k.......z...0.......4...........................+...>...............0...........4.......D.......S.......f.......~...........................'.......8.......,.......&...I...+...p...*.......................3......."...........A...-...Q...............................................................................2.......J...M...j.......................................&.......=.......S.......o...........................'............... ...#.......

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\pt_PT\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 973 messages, Project-Id-Version: electrum ' (Sem a taxa FX dispon\303\255vel)'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):73705
                                                                                                                                                                                                                      Entropy (8bit):5.181939040295811
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:GXrQUm5Kqmw+slscB7AnwTm+PXE+r0Kmkk/GWNRr7rHG8S:ErQtsw+slscB7zTE+r0KmQW/HrHZS
                                                                                                                                                                                                                      MD5:9A167D5482B29CCC9F3990AF21CE1851
                                                                                                                                                                                                                      SHA1:C82F093B702608C55C2E2109F225A754ACF3A581
                                                                                                                                                                                                                      SHA-256:09F264D52713ABF2C2362FA33B031FF06F801D1967D46E98AE07C7B3BC675A90
                                                                                                                                                                                                                      SHA-512:A0F8F352EB3BB2ED490DB659F48D091F3A29EEC9F1E9C67341CACF8E32E173BD030627F5673F0F55873D071250875E3D67B3173C4AFECD97CDB2D16C01E96D52
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.........................<......0Q......1Q......JQ......XQ......_Q......jQ......yQ.......Q.......Q.......Q.......Q.......Q.......Q.......Q.......Q.......Q.......R.......R......'R......-R......5R......BR......JR......\R......eR......rR.......R.......R.......R.......R.......R.......R.......R.......R.......R.......R.......R.......R.......R.......S.......S......$S......+S......1S......9S......JS......PS......WS..:...^S.......S..K....S..0....S..m...!T..#....T.......T..N....U..=....U..)....V......;V......JV..0...iV..4....V.......V......rW.......W......~X.......X..0....X.......X.......X.......X.......Y..'....Y..8...<Y......uY..-....Y.......Y.......Y.......Y.......Y.......Y.......Z......&Z......>Z......UZ......kZ.......Z.......Z.......Z.......Z.......Z.......Z.......[..R....[......h[......l[..7....[..O....[.......\.......\......0\..)...7\......a\......}\.......\.......\.......\.......\.......\..;....\..,...)]......V]......d]......o]......u]..O...|]..o....]..2...<^..!...o^..K....^..1....^......

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\ro_RO\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 477 messages, Project-Id-Version: electrum '(Nu este disponibila rata FX)'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):37589
                                                                                                                                                                                                                      Entropy (8bit):5.158904951212258
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:3psXgZNJcVk1mWRE+AnjT+cxsKauwg7E1HcN5ir:5fZgk1meE+AjKcWKx5ir
                                                                                                                                                                                                                      MD5:C13871445AAC5B2B7BEE228143C19510
                                                                                                                                                                                                                      SHA1:22F519DF439A4360FB925D0B36ADDE7530303BCB
                                                                                                                                                                                                                      SHA-256:DF3ABDA48623F6EB7FE069E2FE7BE5AF82CA800C0BB2D222E99A22A308E1FD8C
                                                                                                                                                                                                                      SHA-512:A023DB563E714F3D400E066E4AFF7B1936407850C9AFDF7AED123751D8735FF39D6593E12F1EE879E00A52EC82BDC0B2D4807F1878A5CD395D7465D345464492
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.................................'.......'.......(.......(.......(......*(......=(......L(......^(......w(.......(.......(.......(.......(.......(.......(.......(.......(.......(.......(.......(.......(.......).......)......!)......+)......8)......>)......G)......U)......[)......j)......v).......).......).......).......).......).......).......).......).......).......).......)..:....)......#*..K....*..m...z*..#....*..=....+..)...J+......t+.......+..0....+.......+......v,.......,.......-......$-......0-..'...B-..8...j-.......-..-....-.......-.......-.......-..............).......@.......\.......w...........................................!.......1..../......;/......D/......O/......T/......\/......t/......~/......./......,0..c...D0.......0.......0.......0.......0.......0.......0.......0.......0.......1.......1......51......K1..F...z1..O....1.......2.......2......!2......'2.......2......72......A2......U2......g2......t2.......2.......2.......2.......2.......2.......2.......2.......3......

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\ru_RU\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 1435 messages, Project-Id-Version: electrum ' (\320\232\321\203\321\200\321\201\321\213 \320\262\320\260\320\273\321\216\321\202 \320\275\320\265\320\264\320\276\321\201\321\202\321\203\320\277\320\275\321\213)'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):167422
                                                                                                                                                                                                                      Entropy (8bit):5.471644017577329
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:IszgVvMytVw+slsZ7oJkXJeaE+TQnCN5FPiAhikQRHYtoIi8SOZZtCwbEAAps:IszGvMPyZkG5BiNkSc99SOZZUwbEAAps
                                                                                                                                                                                                                      MD5:CCFD003180F39F0D9E7E597CAF57DF80
                                                                                                                                                                                                                      SHA1:5D0B74993AB190B7641029A6CAEE3016C9561FB1
                                                                                                                                                                                                                      SHA-256:39737EB87FAA3D8DB9FC7B145C792B090BC5C65188E0086BEBA9DC0F5C64B6C3
                                                                                                                                                                                                                      SHA-512:6A1EF88DEA76A793EA440645BAB701E340B793D8D27C3A20C975DD18FA45DD2E485A1165C979D9318836CE9055BA1605676D00531B997E318FBD0587D92D657A
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.................,..y....Y.......w.......w.......w.......w.......w.......w.......w.......x.......x......"x......4x......Mx......Ux......[x......nx......|x.......x.......x.......x.......x.......x.......x.......x.......x.......x.......x.......x.......y.......y......!y.......y......4y......=y......Ky......Qy......`y......ly......yy.......y.......y.......y.......y.......y.......y.......y.......y.......y.......y..:....y.......z..K...$z..0...pz..m....z..#....{......3{..N....|..=...S|..)....|.......|.......|..0....|..4....}......O}.......}......{~.......~..........0...&.......W.......g.......v...........'.......8.......*......."... .......C...-...S............................................................................1.......Q.......h.......~.....................................................).......:.......L.......`.......i..."...m...........................7.......O...........@...K...N...................).................................. .......2.......A.......`...;...r...,...

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\si_LK\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 1594 messages, Project-Id-Version: electrum ' (FX \340\266\234\340\267\217\340\267\203\340\267\212\340\266\255\340\267\224\340\267\200\340\266\232\340\267\212 \340\266\261\340\267\234\340\266\270\340\267\220\340\266\255)'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):234865
                                                                                                                                                                                                                      Entropy (8bit):5.149438650134435
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:qEdt31YMysZVw+slsIUIP1sFJs6uE+D7qCa50G1jJ6eTkdvq445Tpf/QTVxw:qAoWwWb5pd8eTkdvq4gTJ/m8
                                                                                                                                                                                                                      MD5:B35BCE80529919BCE159D0AFDF63F552
                                                                                                                                                                                                                      SHA1:7D877FCD017CBC40F831ED846528E306644DFEC6
                                                                                                                                                                                                                      SHA-256:76DF5A740EFAE3E7B7503D30CEE62517139970A64E2DCC720E5CDF66EC0913AE
                                                                                                                                                                                                                      SHA-512:0CEE70A3E17588BB7CA98CD9CFAFFE59C9FC3728176A5182D18F53E4877B6E6244EF667A7375DABCBFFB3D7E97D36E4BFC2E42459A9B88F200D7A8D97F159318
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:........:........1..Q....c..............................(......./.......:.......I.......\.......c.......r............................................................................................................,.......5.......B.......T.......Z.......d.......q.......w.......................................................................................................................:...........U...K...`...0.......m......#...K.......o...=...@...)...~...................0......4...........<..............h..........0...........2.......B.......Q.......]...'...o...8.......*..............-...........9.......A.......Q.......c.......z.....................................................(.......D......._.......{.................................................R...........U..."...Y.......|...........7.......O..........+...K...9...................).............................................'...,.......T.......s...;.......,......................................O.......o...

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\sk_SK\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 1338 messages, Project-Id-Version: electrum ' (Nie je k dispoz\303\255cii v\303\275menn\303\275 kurz)'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):124922
                                                                                                                                                                                                                      Entropy (8bit):5.429106778045282
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:0LVfjtNTCQCY2NoVw+slsShoXAp8gTE+yEnCkUUj3smbDxR:cVBNBwIYlUEsmbdR
                                                                                                                                                                                                                      MD5:C60D4F116F16F032B7F7E1E10C377451
                                                                                                                                                                                                                      SHA1:4262BCA935A1FC4B8AA96C369C12CD86ADBA43F0
                                                                                                                                                                                                                      SHA-256:1F8437B3886ACF652C3F3C8EBD934EC877A4C09EEBA006E4F9FF5D6F350BAA6B
                                                                                                                                                                                                                      SHA-512:A853264A030260ADE7777559A3697E5806087D10DEA97AE70EF70AA892165C35017AA30AEE750EDAD1C31F2A2589EE4FD1BD4DB154FFFEBD836D801C229B169C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:........:........).......S.......o.......o.......o.......o.......o.......o.......o.......p.......p......%p......>p......Fp......Lp......Zp......ep......pp.......p.......p.......p.......p.......p.......p.......p.......p.......p.......p.......p.......p.......q.......q.......q......"q......1q......=q......Jq......Pq......eq......nq......uq......|q.......q.......q.......q.......q.......q..:....q.......q..K....q..m...Ar..#....r..=....r..)....s......;s......Js..0...is.......s......=t.......t..0....t.......u.......u......,u......8u..'...Ju..8...ru.......u..-....u.......u.......u.......v.......v......*v......Bv......Zv......qv.......v.......v.......v.......v.......v.......w......3w......=w......Rw......dw......xw.......w.......w..7....w..O....w...... x.......x......Ix..)...Px......zx.......x.......x.......x.......x.......x..;....x..,...3y......`y......ny......ty..O...{y..o....y..2...;z..!...nz..K....z..1....z.......{.......{..9...+{..8...e{.......{.......{.......{..(....{.......{..`....|..b...

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\sl_SI\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 69 messages, Project-Id-Version: electrum 'Dokumentacija'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4112
                                                                                                                                                                                                                      Entropy (8bit):5.090561578705347
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:VvdCFpNnLGXixzj7hoYq8ZljVu3KIsKeQIsKDz6oX/06RqBjPdyjxG90j1zabd7G:KSSnfq8bjVuJsxsPoXM6RAL8xpQo6Le
                                                                                                                                                                                                                      MD5:C0F1F2D057A659AA86081C5E73D4FBA5
                                                                                                                                                                                                                      SHA1:844CDA4FB3DD29D16342E9692B273B8BC4BFF065
                                                                                                                                                                                                                      SHA-256:2B7258380BC8132FFECF3CDFFBA9BE4B20F3B97B79657A57B53475B1EEA9F7A5
                                                                                                                                                                                                                      SHA-512:5FF2745473EF1E88F947ED3009BA8DB260C3BDE1DFE5F2536D95A700CC39802896555949AEC289544B71EDE499EB18E8B276DF60B464E922FCC22AA58D23A577
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:........E.......D...a...l...............................................................'.......?.......W.......^.......f.......~.......................................................................................".......9.......T.......h..."...............................................................u...).......................................................................'.......B.......W.......m.......u......................................................./...!...M.......o.......t... ...y... ...........................................................0.......E...L...Q...............................................................................................................................................!.......(.......2.......D.......V.......p.......w.......|...............................................................................................................................................&.......;.......P.......W.......].......d.......k.......v.......}.......

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\sr_CS\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 1 message, Project-Id-Version: electrum
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):677
                                                                                                                                                                                                                      Entropy (8bit):5.40070947703182
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:i4VxjCt0d7/41r7WXmBQWivXmBQWii3bbkHzkj7f3ZPqAmZkTj8bpX:RHjCt0dTs7WXmQXmHn+gjj9pmUjA5
                                                                                                                                                                                                                      MD5:5E0DCD19318D48A2ACDA9AC98FBBC98F
                                                                                                                                                                                                                      SHA1:C75B5FA3CF64CA3F23AA05AD43F7EBFBA4974501
                                                                                                                                                                                                                      SHA-256:62B0DD23F5FE3D637C36D02566E16957D048776368580C7C9D78CBBA75B4FA07
                                                                                                                                                                                                                      SHA-512:13748234E7752779F862568DB11C5D4F7328B1E517F5DB8E272527CB09F835F2A8A64C1C78CDE7B2E648A559E6DDA997C5882BD0E76BBD8E711F9CC025AFC844
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:................$.......,.......8...k...9................Project-Id-Version: electrum.Report-Msgid-Bugs-To: .PO-Revision-Date: 2024-02-21 17:10.Last-Translator: .Language-Team: Serbian (Latin).Language: sr_CS.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.MIME-Version: 1.0.Content-Type: text/plain; charset=UTF-8.Content-Transfer-Encoding: 8bit.X-Qt-Contexts: true.Plural-Forms: nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && n%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);.X-Crowdin-Project: electrum.X-Crowdin-Project-ID: 20482.X-Crowdin-Language: sr-CS.X-Crowdin-File: /electrum-client/messages.pot.X-Crowdin-File-ID: 68..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\sv_SE\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 682 messages, Project-Id-Version: electrum ' (Ingen v\303\244xlingskurs tillg\303\244nglig)'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):44649
                                                                                                                                                                                                                      Entropy (8bit):5.189850819840373
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:PrAeTbkk9y67L4NSsJyq3RmxBaMHIvUs/1ULqC:DAeTbkYyfNSsJyq3Rmvw/1ULt
                                                                                                                                                                                                                      MD5:3AF04DE003CD413771479B968549D5E2
                                                                                                                                                                                                                      SHA1:7A3866F96522D9BAE5A616D0AF6AA0B53360CF7E
                                                                                                                                                                                                                      SHA-256:B5D691B8D9826B803B5D59587D63D4B5EB4F515EC76D568C3F4A640E1086BC4B
                                                                                                                                                                                                                      SHA-512:6E4369595B12E5ACE235F6252AA4732175501749C1C64B7D0D865DB452620F6F12E65D7968F844BBFBC9583B088DB2F42D70FB1A0D6B7C222541DF7E6F17DB04
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:................l........*.......8.......8.......9...... 9......'9......29......A9......T9......[9......j9......|9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......9.......:.......:......$:......-:......::......L:......R:......\:......i:......o:......x:.......:.......:.......:.......:.......:.......:.......:.......:.......:.......:.......:.......:.......;.......;.......;..:....;......T;..#..._;..N....;..=....;..)....<......:<......I<..0...h<.......<......<=.......=..0....=.......>.......>......'>..8...9>..*...r>.......>..-....>.......>.......>.......>.......?.......?......4?......L?......c?......y?.......?.......?.......?.......?.......@.......@......$@......-@......1@......D@......R@......m@......t@.......@.......@.......@.......@.......@.......@.......A.......A.......A..O....A..o...kA..!....A..K....A..1...IB......{B.......B..9....B..8....B.......C.......C......,C..(...:C......cC......rC..2...}C.......C.......C.......C.......C.......C.......C.......D......

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\ta_IN\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 39 messages, Project-Id-Version: electrum '\340\256\207\340\256\265\340\257\215\340\256\265\340\256\277\340\256\237\340\256\244\340\257\215\340\256\244\340\256\277\340\256\262\340\257\215 \340\256\222\340\256\260\340\257\201 \340\256\252\340\256\260\340\256\277\340\256\265\340\256\260\340\257\215\340\256\244\340\257\215\340\256\244\340\256\251\340\257\210 \340\256\225\340\256\237\340\257\215\340\256\237\340\256\243\340\256\256\340\257\215 \340\256\252\340\256\260\340\256\277\340\256\250\340\257\215\340\256\244\340\257\201\340\256\260'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3933
                                                                                                                                                                                                                      Entropy (8bit):5.260876559579667
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:YiNReugw5WCs7LdxdE4iD/15i6TNtiDte9cadVlv:YiXPTWCsHN4D11NcjWlv
                                                                                                                                                                                                                      MD5:A6B59A5F66E0BF099E9E5C32F3BCC50B
                                                                                                                                                                                                                      SHA1:BFFABB96FD9469A99F8F2846576635EEF1F2E41C
                                                                                                                                                                                                                      SHA-256:F83BD5951530A70F3B27BE45F10DB18810AD3CF2E51DC8E86453F22B9241ED30
                                                                                                                                                                                                                      SHA-512:06147E0B5C445D0193B742F0969F6FF7C3F65F98A93BF2838164F2B4A5FD3219B259C61D4C84F661497C4ADB55F3361088FF6DC4F92D418DE2221E3678AD70AA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:........'.......T...5...........`.......a...............................".......9.......@.......H...c...`.........................................................................../...........K.......S.......e.......|..........................."...................!.......6.......S.......j................... ..............................................................."...........&.......9..."...F..."...i...%...............................................J...........S.......`.......s...............................;.......N.......g.......z.......................................................................................0.......@.......M...............................................................................................................$.......................%... ..."...........&...............#...............!...'........................A suggested fee is automatically added to this field. You may override it. The suggested fee increases with the size of the transaction

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\th_TH\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 388 messages, Project-Id-Version: electrum ' (No FX rate available)'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):42319
                                                                                                                                                                                                                      Entropy (8bit):5.27677882211261
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:U4H6V54gVCJ+/Xyw+slsDWG1sXnaRI9V8LZIWVz6p+1nga9VpMZycwRfmuegYHC/:UgkxS+/iw+slsDWlXaW+WdEkuBDA/yHZ
                                                                                                                                                                                                                      MD5:8BEE96E7F743CD14F6D5E01153147E29
                                                                                                                                                                                                                      SHA1:767C8CC3343AE19010AF42449E51956C7DEE7E8F
                                                                                                                                                                                                                      SHA-256:1EBE2F0BF39DC4D6157DEAA5F648502AA2C8BA3FB08C35677F4C7C35CECCD851
                                                                                                                                                                                                                      SHA-512:7461BE1EF1576263ECB3BC01783EDA1C3BA1C598B716E23FDB7DCBCD4682A56ADDE8279819962A2F8C32F2F0540D8FDC803AC6ED9391C4EDFB39FCC058A7D03D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:................<.......\........ ....... ....... ....... ....... ....... ....... ....... ....... ....... .......!.......!......%!......+!......>!......L!......W!......b!......w!......}!.......!.......!.......!.......!.......!.......!.......!.......!.......!.......!.......!......."......."......."......#"....../"......<"......B"......W"......`"......g"......n"......t"......|"......."......."......."..:...."......."..K...."..0...3#..m...d#..#....#.......#..=....$..)....%....../%......>%..0...]%..4....%.......%......f&.......&......r'.......'.......'..'....'..8....'..*....(......2(..-...B(......p(......x(.......(.......(.......(.......(.......(.......(.......).......)......8)......M)..R...V).......).."....).......)..7....)..O....*......k*......y*.......*..)....*.......*.......*.......*.......*.......+......0+..;...B+..,...~+.......+.......+.......+..O....+..o....,..2....,..!....,..K....,..1...'-......Y-......b-..9...v-..8....-.......-.......-..........(...........A.......P...`...[...b...

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\tr_TR\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 853 messages, Project-Id-Version: electrum ' (D\303\266viz kuru yok)'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):59874
                                                                                                                                                                                                                      Entropy (8bit):5.299234498954761
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:eZZD8J5+AlWPM0atWvIe/yPc1LQKfIOOUhmaYIE+vxPSfa+slSOK16RXuyYOyowv:8D8XhfhWNqPc1rOUhmRIE+vsllYpyXv
                                                                                                                                                                                                                      MD5:DFC911B75B4245129713A767B8F77B09
                                                                                                                                                                                                                      SHA1:7008A313FC61EC95C5A462057FA6AE6E00E227B5
                                                                                                                                                                                                                      SHA-256:59BCF8E72069A92290DE0FF4E26976E989E49BC0D110B0AFA270427D0291A4C6
                                                                                                                                                                                                                      SHA-512:89CC2BCAAF7AC8CC4E62CF356CD2F815483714123F46788BBFFF9347755B4F987F74811E6DCFCE2703EB6ABA1CB4050CBE4B816617272C32D3F98E63BDD6B6D9
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:........U...............l5......hG......iG.......G.......G.......G.......G.......G.......G.......G.......G.......G.......H.......H.......H......&H......4H......?H......JH......_H......eH......mH......zH.......H.......H.......H.......H.......H.......H.......H.......H.......H.......H.......H.......H.......I.......I......$I......*I......?I......HI......OI......VI......\I......dI......uI......{I.......I..:....I.......I..K....I..m....J..#....J.......J..N...~K..=....K..)....L......5L......DL..0...cL..4....L.......L......lM.......M..0....N......<N......LN......[N......gN..'...yN..8....N.......N..-....N.......O...... O......0O......BO......YO......qO.......O.......O.......O.......O.......O.......P......$P......@P......]P......gP......|P.......P.......P..7....P..O....P......$Q......2Q......MQ..)...TQ......~Q.......Q.......Q.......Q.......Q.......Q.......Q..;....R..,...FR......sR.......R.......R.......R..O....R..o....R..2...YS..!....S..K....S..1....S......,T......5T..8...IT.......T.......T......

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\uk_UA\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 1317 messages, Project-Id-Version: electrum ' (\320\235\320\265\320\264\320\276\321\201\321\202\321\203\320\277\320\275\320\260 \321\226\320\275\321\204\320\276\321\200\320\274\320\260\321\206\321\226\321\217 \320\277\321\200\320\276 \320\272\321\203\321\200\321\201 \320\276\320\261\320\274\321\226\320\275\321\203)'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):155061
                                                                                                                                                                                                                      Entropy (8bit):5.4808363359055745
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:smVMCKQt2HJFuIVw+slsxZolkYJVE+J8uCFEiGU6VPvmh0Ihgqf+0c:smVMhQtX+CZ2lXLf8
                                                                                                                                                                                                                      MD5:C30B174AA0F77DC089D295F707294217
                                                                                                                                                                                                                      SHA1:19548D26AD508E698A4C9A011221B78835EDDF57
                                                                                                                                                                                                                      SHA-256:07EA88D3ED5525092AFF47F3522BC7D7A8E7C6AF29AE22E6B2B917D3E777A58D
                                                                                                                                                                                                                      SHA-512:8084C4E2126627661F822657B2CD2EED0E168004975AFFBD6878BEF913C015D54A4176E600F58576B269DC76AE60A2B03F022C6235B15FBB4143B67AD7AD64D9
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:........%.......D)......lR.......m.......m.......n.......n.......n......"n......1n......Dn......Kn......Zn......ln.......n.......n.......n.......n.......n.......n.......n.......n.......n.......n.......n.......o.......o.......o......)o....../o......9o......Fo......Lo......Uo......co......io......xo.......o.......o.......o.......o.......o.......o.......o.......o.......o.......o.......o.......o..:....o......1p..K...<p..m....p..#....p..=....q..)...Xq.......q.......q..0....q..4....q.......r.......r......Bs.......s..0....s.......t.......t......+t......7t..'...It..8...qt..*....t.......t..-....t.......u.......u......+u......=u......Tu......nu.......u.......u.......u.......u.......u.......v.......v......:v......Wv......av......vv.......v.......v..R....v.......v.......v..7....w..O...Gw.......w.......w.......w..)....w.......w.......x.......x......+x......=x......\x..;...nx..,....x.......x.......x.......x.......x..O....x..o...My..2....y..!....y..K....z..1...^z.......z.......z..8....z.......z......

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\vi_VN\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 212 messages, Project-Id-Version: electrum ' (Kh\303\264ng c\303\263 \304\221\303\241nh gi\303\241 FX s\341\272\265n c\303\263)'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):14470
                                                                                                                                                                                                                      Entropy (8bit):5.452796142109212
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:fz2DrLU4mGUbpbNWD8UVdOPXr+vAJDQCDDbjohsxsvhJ4g6Rf6UU6RAb6oMVentp:6k4yNbsD8UVdX8TJmvU6UU3iVg+wyQ
                                                                                                                                                                                                                      MD5:4CBF45008DE09E614827145464F800EA
                                                                                                                                                                                                                      SHA1:DFDB3C122A646DBA35BC9E932F3E9587A96103EA
                                                                                                                                                                                                                      SHA-256:B2F7C83AC1288A9013E13A1B07F0399C67CCF84EA9CD05DB5032D07CFED5F655
                                                                                                                                                                                                                      SHA-512:17E5F08D46F005D49B00CC11DDC28D324F9AE7A2A99FA92F55CB782AEF1135193ABD95E1A95A36570FEA895EBB964ADF36F80B694CF5174B744D5B44AABD22D7
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:........................\...............................................................$.......+.......:.......L.......e.......m.......s...............................................................................................................".......,.......9.......?.......H.......V.......\.......k.......w...................................................................................)...........................................................................................).......4.......9.......A.......Y.......c.......}...........c...)...............................................................................................0...F..._...O...........................................................&.......:.......L.......Y.......n.......w.......|.........................................................................../...........5.......=.......J..."...j...................j..........."...f...7...........G.......1.......-...(...4...V...4...................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\zh_CN\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 2422 messages, Project-Id-Version: electrum ' (\346\227\240\345\217\257\347\224\250\346\261\207\347\216\207)'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):221874
                                                                                                                                                                                                                      Entropy (8bit):6.266441510902598
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:Y8puDayJMtsoggGcHVw+slsSJiQKsLFvyTK7gMV2YE+/D8ULAC+kA+QjLmvrbD7C:tZwuxgv4mMIDaFkDrvdgH
                                                                                                                                                                                                                      MD5:5B3B6A6B108461548D2E747E80FC9A79
                                                                                                                                                                                                                      SHA1:93128EC542FBC0E1C750D3EB63A9A74905BFD1C8
                                                                                                                                                                                                                      SHA-256:60494D88CB14B66F3630BA54068C5D9159DE6DA278A349EE1C5499CD981401F3
                                                                                                                                                                                                                      SHA-512:EB654AF40E3EA0A4E8E753DF1B6F200F8524195C33233CC8499997EBFA08EEB79D1F436B1A30BC27CD873276BC88A51201C87B68660A171069383379CCF39237
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:........v........K......|...............................................*.......9.......L.......S.......b.......t...............................................................................................................%.......2.......?.......F.......X.......^.......h.......u.......{........................................................................................................................... .../.......P...$...f...%.......................................:...............K.......0...f...m.......#...........)...N.......=...I...).......................0.......4...........E...............q...L.......>...A...................0...........................................#.......7.......I.......X.......d.......v...'.......8.......,.......'.......&...<...+...c...*.......................3......."...........4...-...D.......r.......z...............................................................%.......=...M...]...............................................0.......F.......b.......

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\locale\zh_TW\LC_MESSAGES\electrum.mo

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:GNU message catalog (little endian), revision 0.0, 589 messages, Project-Id-Version: electrum ' (\345\214\257\347\216\207\350\263\207\350\250\212\344\270\215\345\217\257\347\224\250)'
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):43684
                                                                                                                                                                                                                      Entropy (8bit):5.971054846593842
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:1IIAaxOLpnPl3i1cnT4ymabE+rVAgZUWN617w/wgDdg1oTopWWOdf5cAQai9:1IIYPJimnT4ym+E+rSc6C4+og9df5wz
                                                                                                                                                                                                                      MD5:52349AD8C65F391B3A224C32B14D5399
                                                                                                                                                                                                                      SHA1:825A4FFFDF7CA9145557801F02A757401812C0EA
                                                                                                                                                                                                                      SHA-256:650125A7526B0CC13DB2DD958E0089C3840D02247D5D47008F92E0C9037E07E6
                                                                                                                                                                                                                      SHA-512:FB6B7018B6283533D9E2A567BB2D5051AC3B7DA85015A0947E41B6CB8759F93E99E50BE676345B788AEE1BBFC2D3434BEC95AC03C95AAD1246FF09F3E4B398BE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:........M................$......81......91......R1......`1......g1......r1.......1.......1.......1.......1.......1.......1.......1.......1.......1.......2.......2.......2....../2......52......=2......J2......R2......d2......m2......z2.......2.......2.......2.......2.......2.......2.......2.......2.......2.......2.......2.......2.......3.......3.......3......&3......,3......43......E3......K3......R3..:...Y3.......3..K....3..0....3.......4..N....4..=...<5..)...z5.......5.......5..0....5..4....6......86.......6......d7.......7.......7.......8.......8..'...*8..8...R8..*....8.......8..-....8.......8.......8.......9.......9......59......O9......g9.......9.......9.......9.......9.......9.......:.......:......%:..R....:.......:.."....:.......:.......:..7....:..O....;......W;..K...e;.......;.......;..)....;.......;.......<......*<......7<......I<..'...X<.......<.......<..,....<.......<.......<.......<.......<..O....=..o...T=..2....=..!....=..K....>..1...e>.......>.......>..9....>.......>......

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\README

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1525
                                                                                                                                                                                                                      Entropy (8bit):4.308909802534244
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:Rg1PepJW3MdGwZVc/qVRHv9Fv8Rx8tPhAjOTNkNITuGTkAz+pzoAxq4iZv9q3A:q12pJYSGnSVRHTv8R8yjOpBTkAovRiZz
                                                                                                                                                                                                                      MD5:C818A526EC8E002419BB86F9B791AE21
                                                                                                                                                                                                                      SHA1:6633DCF0BDAF6DA74BEE0DA01FC67D36A130DF69
                                                                                                                                                                                                                      SHA-256:A4A22B8BF021FEB1096C611F4F5A9EDA63D6C189A5609C1460718EBF87FABB17
                                                                                                                                                                                                                      SHA-512:541EA923A28BE16A6940E0306D62DE71BC4D25DD1E85E17B80DFF5568F3BA63EFDAD5B6EF259E797E300B7DF0644DC796F8754259AB95625F43BDE672673B2C4
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:Plugin rules:.. * The plugin system of Electrum is designed to allow the development. of new features without increasing the core code of Electrum... * Electrum is written in pure python. if you want to add a feature. that requires non-python libraries, then it must be submitted as a. plugin. If the feature you want to add requires communication with. a remote server (not an Electrum server), then it should be a. plugin as well. If the feature you want to add introduces new. dependencies in the code, then it should probably be a plugin... * We expect plugin developers to maintain their plugin code. However,. once a plugin is merged in Electrum, we will have to maintain it. too, because changes in the Electrum code often require updates in. the plugin code. Therefore, plugins have to be easy to maintain. If. we believe that a plugin will create too much maintenance work in. the future, it will be rejected... * Plugins should be compatible with Electrum's convention

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\__init__.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1164
                                                                                                                                                                                                                      Entropy (8bit):5.131212790283945
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:UIxok4JHWWV0yPP3VtkHe1oai9QHlsUjH8Ok46+d5Eo3DqeFs:UMotJdVlPvLTmawQHlsyHIO5d3D1Fs
                                                                                                                                                                                                                      MD5:4F2F1D52356EF8175E80B790A2CC8004
                                                                                                                                                                                                                      SHA1:F30F2EE67771A1B57AEA74319F6CBD49B55BDB11
                                                                                                                                                                                                                      SHA-256:D05BF2C5E001E8642AC43A0399F4681C48E94A1FEB2D37EE073E243D7547735E
                                                                                                                                                                                                                      SHA-512:7329029BF99337D0A1B353BF155F66E09B1200263E4F4CCA898CBD1E145F53A5573AF85FF0453DF54B196544F888FD3C6C0CD5DCE35599D5ABCD3826939B1569
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:#!/usr/bin/env python.#.# Electrum - lightweight Bitcoin client.# Copyright (C) 2015 Thomas Voegtlin.#.# Permission is hereby granted, free of charge, to any person.# obtaining a copy of this software and associated documentation files.# (the "Software"), to deal in the Software without restriction,.# including without limitation the rights to use, copy, modify, merge,.# publish, distribute, sublicense, and/or sell copies of the Software,.# and to permit persons to whom the Software is furnished to do so,.# subject to the following conditions:.#.# The above copyright notice and this permission notice shall be.# included in all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\audio_modem\__init__.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):214
                                                                                                                                                                                                                      Entropy (8bit):4.927871904173466
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:1YvQ7rhF17v6IFP8EGYGP1/JFuAyEKLfKhbfOVrI7:1YvQJF176eVTQ/pyEKKAV07
                                                                                                                                                                                                                      MD5:6790EF548CB2261AD89A53C5C3D0CFF4
                                                                                                                                                                                                                      SHA1:422AB91148D7A45B9F95E2A866C42A112DD3AE85
                                                                                                                                                                                                                      SHA-256:0A038364785B2A50A43A3EBB2ADB079E1DA54D81F050FC815A6B4025D723650E
                                                                                                                                                                                                                      SHA-512:0D8CDAA2A8B6EB90184E84817A7E6C13277580AD98B2B8E555167EB4CD935FE5B6DAA800170723C1A34E3C8BF5E8D9DE0062B64B2A97F7E99B564F808EE255DF
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from electrum.i18n import _..fullname = _('Audio MODEM').description = _('Provides support for air-gapped transaction signing.').requires = [('amodem', 'http://github.com/romanz/amodem/')].available_for = ['qt']..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\audio_modem\qt.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4293
                                                                                                                                                                                                                      Entropy (8bit):4.671629688157907
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:k6IjmUaWG4flas0JqWRfR5y9VzJqC/Mz4T4M:kBIly97AC4M
                                                                                                                                                                                                                      MD5:F1069BB5F0A50A1BCE038DF8944355A8
                                                                                                                                                                                                                      SHA1:AB214EAF4EEF7FBDF9A26824026183AF5B13964D
                                                                                                                                                                                                                      SHA-256:37C15EE2AC33135163692FA35F63F2297D77BA3DFDF8E0AF6547CBB70C45CBF1
                                                                                                                                                                                                                      SHA-512:2B93A3E9D4F7D3528D7A515D6EF5846F1F31AAC3F4B7CD3EAB13BD7CBFB1A5E6D427F0B954C311B45E82B7B49846D59A4577FAC81AF25BD15B3412C4C89CD191
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from functools import partial.import zlib.import json.from io import BytesIO.import sys.import platform.from typing import TYPE_CHECKING..from PyQt5.QtWidgets import (QComboBox, QGridLayout, QLabel, QPushButton)..from electrum.plugin import BasePlugin, hook.from electrum.gui.qt.util import WaitingDialog, EnterButton, WindowModalDialog, read_QIcon.from electrum.i18n import _.from electrum.logging import get_logger..if TYPE_CHECKING:. from electrum.gui.qt.transaction_dialog import TxDialog..._logger = get_logger(__name__)...try:. import amodem.audio. import amodem.main. import amodem.config. _logger.info('Audio MODEM is available.'). amodem.log.addHandler(amodem.logging.StreamHandler(sys.stderr)). amodem.log.setLevel(amodem.logging.INFO).except ImportError:. amodem = None. _logger.info('Audio MODEM is not found.')...class Plugin(BasePlugin):.. def __init__(self, parent, config, name):. BasePlugin.__init__(self, parent, config, name). if self.is

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\bitbox02\__init__.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):342
                                                                                                                                                                                                                      Entropy (8bit):4.81573664495697
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:1YvQ7rhHpXeeawJ6IFlX2UEiVMr8/KI+eQhCag03KNQohQiIXdQGVbRC:1YvQJJXeRwJ6AXxVVWST+p0aNAJIX2Gi
                                                                                                                                                                                                                      MD5:A4F7A31824929EEEB0B69FE5AE80F9BE
                                                                                                                                                                                                                      SHA1:3114463FA7C37DC91487FE3DEDFA5C13E33A9DF8
                                                                                                                                                                                                                      SHA-256:868C0438C6AC79EB4A5AE1CF57A0649EB20C9DD936256A553A5269E2826AE08B
                                                                                                                                                                                                                      SHA-512:2D703F9C0BBD34319739531ED482DEB3C143026A18A8FFF76A942BF24D832C5E02266935BD77E7594DA72D218F1E90C727C9B10DCC6B16445F6265C1072A7196
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from electrum.i18n import _..fullname = "BitBox02".description = (. "Provides support for the BitBox02 hardware wallet".).requires = [. (. "bitbox02",. "https://github.com/digitalbitbox/bitbox02-firmware/tree/master/py/bitbox02",. ).].registers_keystore = ("hardware", "bitbox02", _("BitBox02")).available_for = ["qt"].

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\bitbox02\bitbox02.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):27768
                                                                                                                                                                                                                      Entropy (8bit):4.484397604833554
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:5Maamch5D5d9w8QwUUvK4pDP/p7KXPS7Ig:5Uw8QuvK4pDP/4Xg
                                                                                                                                                                                                                      MD5:787D0A299737B7F5EE1972AC283FFA57
                                                                                                                                                                                                                      SHA1:8CA1432F23357D49684F993ACD89EE46E90FF661
                                                                                                                                                                                                                      SHA-256:1866583711BBB2F7D483D8EF5A5909F4349EECAE100E449C041C37C901EEF18E
                                                                                                                                                                                                                      SHA-512:DE483529225142C180CFFB27B27F49893CF0A7A092C342E76DD0EB8FD8F2F3430B624E6D481A0DE890C9AECA8E53521673790C4190728D6B4544B5B9A1D696EA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:#.# BitBox02 Electrum plugin code..#..import hid.from typing import TYPE_CHECKING, Dict, Tuple, Optional, List, Any, Callable..from electrum import bip32, constants.from electrum.i18n import _.from electrum.keystore import Hardware_KeyStore.from electrum.transaction import PartialTransaction, Sighash.from electrum.wallet import Multisig_Wallet, Deterministic_Wallet.from electrum.util import UserFacingException.from electrum.logging import get_logger.from electrum.plugin import Device, DeviceInfo, runs_in_hwd_thread.from electrum.simple_config import SimpleConfig.from electrum.storage import get_derivation_used_for_hw_device_encryption.from electrum.bitcoin import OnchainOutputType..import electrum.bitcoin as bitcoin.import electrum.ecc as ecc..from ..hw_wallet import HW_PluginBase, HardwareClientBase, HardwareHandlerBase..if TYPE_CHECKING:. from electrum.wizard import NewWalletWizard.._logger = get_logger(__name__)...try:. from bitbox02 import bitbox02. from bitbox02 import ut

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\bitbox02\qt.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5643
                                                                                                                                                                                                                      Entropy (8bit):4.7627608623319
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:jQmy0hAHGWr0R30XV1SfInwJy9vDlptPHmsqJCHsUqTTSh:kaGmvOL8o9lrqzSh
                                                                                                                                                                                                                      MD5:E03CB4AEDED7CEF59F49FEBE14025E2A
                                                                                                                                                                                                                      SHA1:2D795898789DE87CE04643664A9D23FDDFC07001
                                                                                                                                                                                                                      SHA-256:944725841380108F2FDFFD8A76920108D95D9BC45AB3C5C1EFC2BD16734A4E7A
                                                                                                                                                                                                                      SHA-512:CD9F67AF1F488DFAD5F4FFFD138CB80676C8D963BB2102460CED826724284E8E970E0332218119952FF7880B7CC477F326F372486E3D2411F70BE8D8A2F8F0E0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:import threading.from functools import partial.from typing import TYPE_CHECKING..from PyQt5.QtCore import Qt, QMetaObject, Q_RETURN_ARG, pyqtSlot, pyqtSignal.from PyQt5.QtWidgets import QLabel, QVBoxLayout, QLineEdit, QHBoxLayout..from electrum.i18n import _.from electrum.plugin import hook.from electrum.util import UserCancelled, UserFacingException..from .bitbox02 import BitBox02Plugin.from ..hw_wallet.qt import QtHandlerBase, QtPluginBase.from ..hw_wallet.plugin import only_hook_if_libraries_available, OperationCancelled..from electrum.gui.qt.wizard.wallet import WCScriptAndDerivation, WCHWUnlock, WCHWUninitialized, WCHWXPub.from electrum.gui.qt.util import WindowModalDialog, OkButton, ButtonsTextEdit..if TYPE_CHECKING:. from electrum.gui.qt.wizard.wallet import QENewWalletWizard...class Plugin(BitBox02Plugin, QtPluginBase):. icon_unpaired = "bitbox02_unpaired.png". icon_paired = "bitbox02.png".. def create_handler(self, window):. return BitBox02_Handler(window)..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\coldcard\README.md

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1599
                                                                                                                                                                                                                      Entropy (8bit):4.733667781245139
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:3w/sAYSjlkL2p9tJW0AL7gdNlnymtgaAW2VXOYM:3w/CSjU2p9tQ0BNlnyXM2NBM
                                                                                                                                                                                                                      MD5:E23ECE2F407341B9321074891D211AA0
                                                                                                                                                                                                                      SHA1:DAAC9FD399D8DD6BDA56092331BE11B0D302F2C1
                                                                                                                                                                                                                      SHA-256:1988F0E2EE3452D900B75440A500F2CC0AEA7F4FCE4DFEB19353FF46651ECC67
                                                                                                                                                                                                                      SHA-512:1F582B451A8FA9B47F38FD3CE4843E1E6164E0FBB05FEC9EA218865BB0D8A6680B199B7CFEA74E0E1E1BF5FFAFAC2A3C4ECCCB0E07C6EA099F658FACBBD46817
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:# Coldcard Hardware Wallet Plugin..## Just the glue please..This code connects the public USB API and Electrum. Leverages all.the good work that's been done by the Electrum team to support.hardware wallets...## Background..The Coldcard has a larger screen (128x64) and a number pad. For.this reason, all PIN code entry is done directly on the device..Coldcard does not appear on the USB bus until unlocked with appropriate.PIN. Initial setup, and seed generation must be done offline...Coldcard uses the standard for unsigned tranasctions:..PSBT = Partially Signed Bitcoin Transaction = BIP174..The Coldcard can be used 100% offline: it can generate a skeleton.Electrum wallet and save it to MicroSD card. Transport that file.to Electrum and it will fetch history, blockchain details and then.operate in "unpaired" mode...Spending transactions can be saved to MicroSD using by exporting them.from transaction preview dialog (when this plugin is.owner of the wallet). That PSBT is then signed on the C

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\coldcard\__init__.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):308
                                                                                                                                                                                                                      Entropy (8bit):4.780432453957694
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:1YvQ7rhcBTRXrml6IFX0myCDKJSpEG+dwS0wKNQo6KcPleQXBGVrIeCM7in:1YvQJwg6xmyCDKgarBt2x2GV0dM+n
                                                                                                                                                                                                                      MD5:EA4F01C6131621AE973CEB62B3DBC196
                                                                                                                                                                                                                      SHA1:F1A6745F5CA08BBB972C08D3CFB374CA6B65AC98
                                                                                                                                                                                                                      SHA-256:A25ABE5EE2830E4EE8C47D45A6FC5D4A202E0ADB08FCF6C2026108FAF3518D8F
                                                                                                                                                                                                                      SHA-512:AD11CD1FC57EC3D2A6B0D7DFF5C71F420967502EFF971CEC9E2651AE3463645B30B0E6300053684491367837A548A79FF4C9E56C97CF673E09491F50DB7726C6
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from electrum.i18n import _..fullname = 'Coldcard Wallet'.description = 'Provides support for the Coldcard hardware wallet from Coinkite'.requires = [('ckcc-protocol', 'github.com/Coldcard/ckcc-protocol')].registers_keystore = ('hardware', 'coldcard', _("Coldcard Wallet")).available_for = ['qt', 'cmdline'].

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\coldcard\cmdline.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1090
                                                                                                                                                                                                                      Entropy (8bit):4.573310061544046
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:1/d1AZBPxya0mPxrnD8PxS1XXmrxxuPwHvsb/aC9sahfA0yGl:dvAVb0Krn4AixIsvwaCVZ5
                                                                                                                                                                                                                      MD5:8870C7B7E30C1CD7FD068D93A5E3B6DE
                                                                                                                                                                                                                      SHA1:EED10756BCF0F33C70F13FAD219462F53DB9FA5D
                                                                                                                                                                                                                      SHA-256:CD39D765EBB9C0F55B3D7C81C7300B824342E24B3D361AD6A62838665FA99447
                                                                                                                                                                                                                      SHA-512:82922FEF123FB09E3C334E1C8597D3737498C50B155758144BFAD328CB47734FF7E0CFE7919911136D058709A86BEAE16D88386F2C1BE9C862834550C7FE5DA0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from electrum.plugin import hook.from electrum.util import print_msg, raw_input, print_stderr.from electrum.logging import get_logger..from ..hw_wallet.cmdline import CmdLineHandler..from .coldcard import ColdcardPlugin..._logger = get_logger(__name__)...class ColdcardCmdLineHandler(CmdLineHandler):.. def get_passphrase(self, msg, confirm):. raise NotImplementedError.. def get_pin(self, msg, *, show_strength=True):. raise NotImplementedError.. def prompt_auth(self, msg):. raise NotImplementedError.. def yes_no_question(self, msg):. print_msg(msg). return raw_input() in 'yY'.. def stop(self):. pass.. def update_status(self, b):. _logger.info(f'hw device status {b}').. def finished(self):. pass..class Plugin(ColdcardPlugin):. handler = ColdcardCmdLineHandler().. @hook. def init_keystore(self, keystore):. if not isinstance(keystore, self.keystore_class):. return. keystore.handler

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\coldcard\coldcard.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):24659
                                                                                                                                                                                                                      Entropy (8bit):4.600096072868321
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:ET7cFOAFQcAsm0nxFG3iEOtkVtZOTJc8vIVp5DUsAtN:60ulfZrL5DUPv
                                                                                                                                                                                                                      MD5:AE37F81847578906E1BB368CB99C6E5E
                                                                                                                                                                                                                      SHA1:3CE722E0F590E777ACC40148D20D9B87638A74FF
                                                                                                                                                                                                                      SHA-256:E7273E605B53806F92EB490198218841B4BCE3C716EDDB87B48DDB294B4C48C6
                                                                                                                                                                                                                      SHA-512:4EE95AD84F93FD8A0268D89410571C866EFEB65CFC4E3DEA9AEF9B927E1D59B2D3F89AFBFEF873ED0C206D89EDE4266C66BDC9406F5833832952DCBF44CA992E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:#.# Coldcard Electrum plugin main code..#.#.import os.import time.from typing import TYPE_CHECKING, Optional.import struct..from electrum import bip32.from electrum.bip32 import BIP32Node, InvalidMasterKeyVersionBytes.from electrum.i18n import _.from electrum.plugin import Device, hook, runs_in_hwd_thread.from electrum.keystore import Hardware_KeyStore, KeyStoreWithMPK.from electrum.transaction import PartialTransaction.from electrum.wallet import Standard_Wallet, Multisig_Wallet, Abstract_Wallet.from electrum.util import bfh, versiontuple, UserFacingException.from electrum.logging import get_logger..from ..hw_wallet import HW_PluginBase, HardwareClientBase.from ..hw_wallet.plugin import LibraryFoundButUnusable, only_hook_if_libraries_available..if TYPE_CHECKING:. from electrum.plugin import DeviceInfo. from electrum.wizard import NewWalletWizard.._logger = get_logger(__name__)...try:. import hid. from ckcc.protocol import CCProtocolPacker, CCProtocolUnpacker. from ckcc.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\coldcard\qt.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):9720
                                                                                                                                                                                                                      Entropy (8bit):4.7607121749672
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:CCEIRwrvz1dIK2P6ua6NG9UFOi2j1HMjK94:TEI64Sx9UFOi2j1HP4
                                                                                                                                                                                                                      MD5:39CA9012A128A6A73D6FB1D6A806BC3E
                                                                                                                                                                                                                      SHA1:3B58E78EB9F910A41E5A64244E4D86214CD53268
                                                                                                                                                                                                                      SHA-256:EF2C9F1027D540A42683E57AE249D6835ED7DDB69762C3C8460B4A7400C265D3
                                                                                                                                                                                                                      SHA-512:91D1954B41FA490DA3C390956A14C4423879CD1E3A54FA48DDB873C6CA2D8374626A7221A0270257E5AEBFB79EA326DA251581AFBDA9AE5B070EF5A9503C7511
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from functools import partial.from typing import TYPE_CHECKING..from PyQt5.QtCore import Qt.from PyQt5.QtWidgets import QPushButton, QLabel, QVBoxLayout, QWidget, QGridLayout..from electrum.gui.qt.util import WindowModalDialog, CloseButton, getOpenFileName, getSaveFileName.from electrum.gui.qt.main_window import ElectrumWindow..from electrum.i18n import _.from electrum.plugin import hook.from electrum.wallet import Multisig_Wallet..from .coldcard import ColdcardPlugin, xfp2str.from ..hw_wallet.qt import QtHandlerBase, QtPluginBase.from ..hw_wallet.plugin import only_hook_if_libraries_available.from electrum.gui.qt.wizard.wallet import WCScriptAndDerivation, WCHWXPub, WCHWUninitialized, WCHWUnlock..if TYPE_CHECKING:. from electrum.gui.qt.wizard.wallet import QENewWalletWizard..CC_DEBUG = False...class Plugin(ColdcardPlugin, QtPluginBase):. icon_unpaired = "coldcard_unpaired.png". icon_paired = "coldcard.png".. def create_handler(self, window):. return Coldcard_Handler

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\cosigner_pool\__init__.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):380
                                                                                                                                                                                                                      Entropy (8bit):4.759186715601759
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:1YvQdLhFiE7bqMrI+7FVYlARbJvNAk1ThEGe5BMysT/ALeHAfmG/QBwxC3P532Ld:1YvQJh6Mrj7FVRvRTS/ngNgeGc6YGli0
                                                                                                                                                                                                                      MD5:E2BB461D422E50929D6997B2DBE21A2F
                                                                                                                                                                                                                      SHA1:5E177F624FAB2BA8937CDE5CC79E83FBDA438840
                                                                                                                                                                                                                      SHA-256:BB99B42569DC28A3A8D6EB372575952B5AD08B9B384F6BB16A10CE60015D4EC8
                                                                                                                                                                                                                      SHA-512:C4CE543D86B449816003A79D0210356020EBD0035B69721C8CB5571B18D44D14C2DBA2D4356691EB361C3B4852B50CFBBE39A518370FA612A66FE3B2B5829674
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from electrum.i18n import _.fullname = _('Cosigner Pool').description = ' '.join([. _("This plugin facilitates the use of multi-signatures wallets."),. _("It sends and receives partially signed transactions from/to your cosigner wallet."),. _("Transactions are encrypted and stored on a remote server.").]).#requires_wallet_type = ['2of2', '2of3'].available_for = ['qt'].

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\cosigner_pool\qt.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):11676
                                                                                                                                                                                                                      Entropy (8bit):4.662484746362187
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:rzPjdwQHzJD3qvLm0tY9SOUuW3hEnp1ak/WG4/tjBec8kRvcsnAvGta6OPSiMKCO:rdwQHduvLm9rUr3hY11et8PIXQWcSc
                                                                                                                                                                                                                      MD5:34E953135C8DC4322C18F89B4EEBFAAC
                                                                                                                                                                                                                      SHA1:022B9442792DF41089999CE15620BC71F736E991
                                                                                                                                                                                                                      SHA-256:BCD052A9DD43F50DA83B3F2597B3E7F8BAC12DA590F50E594CAEBE037599C726
                                                                                                                                                                                                                      SHA-512:4393985BDAB65A5B12B564D071AD6EC2D008CB319083D9929F16FE07315846AA6A05C398038A95E2DA84812EACDC7A52A9754DF71CEC6711DFBFC5855DF42F07
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:#!/usr/bin/env python.#.# Electrum - lightweight Bitcoin client.# Copyright (C) 2014 Thomas Voegtlin.#.# Permission is hereby granted, free of charge, to any person.# obtaining a copy of this software and associated documentation files.# (the "Software"), to deal in the Software without restriction,.# including without limitation the rights to use, copy, modify, merge,.# publish, distribute, sublicense, and/or sell copies of the Software,.# and to permit persons to whom the Software is furnished to do so,.# subject to the following conditions:.#.# The above copyright notice and this permission notice shall be.# included in all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\digitalbitbox\__init__.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):241
                                                                                                                                                                                                                      Entropy (8bit):4.784377531884513
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:1YvQ7rhiMpgrBkv6IFQWFngKNQo6K1AayX+WGVrIeCM7in:1YvQJiEgFa6pWFg21AXHGV0dM+n
                                                                                                                                                                                                                      MD5:444DDD276080B4DE4EFACE108A2DAAF9
                                                                                                                                                                                                                      SHA1:0A0BBC93200366A16B9E215F9A9FA587113B5B4D
                                                                                                                                                                                                                      SHA-256:96C60D1D9FEDE5EF8010000FC6241BEAC23112C120A52953B52BE3428147F5D7
                                                                                                                                                                                                                      SHA-512:8646AF3BC3A6916881C82CD5AA1BF6E986E652E633060A485200CE29DF1E32A48D0DE9A9561708606A28B7341535AADCE347A1BEDC9597C751E5BE062A806807
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from electrum.i18n import _..fullname = 'Digital Bitbox'.description = _('Provides support for Digital Bitbox hardware wallet').registers_keystore = ('hardware', 'digitalbitbox', _("Digital Bitbox wallet")).available_for = ['qt', 'cmdline'].

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\digitalbitbox\cmdline.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):419
                                                                                                                                                                                                                      Entropy (8bit):4.548925765726323
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:1KM82l8nDMz+85QDMm2Hvsb/aCTATSvehahBNA099a/:1/+fj6Hvsb/aC9sahfA0y/
                                                                                                                                                                                                                      MD5:8631469CD0F206ADAB39997AA499CA9C
                                                                                                                                                                                                                      SHA1:BC5FF5912135E8E31473B8FAD264E5ABFF199A15
                                                                                                                                                                                                                      SHA-256:4CB7671A72CDE8A9F782897998568E89547C41D3C3AE41C5CC4306AB43E75B20
                                                                                                                                                                                                                      SHA-512:A3E0D3BD49DD7E6BCB9E7D432B0D63EF82187A8FA2D9D1543E40683F06473C3D1BD0849E68B68497E32102661A1A5285C186E13ACEDC3904EB217C8715215A43
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from electrum.plugin import hook.from .digitalbitbox import DigitalBitboxPlugin.from ..hw_wallet import CmdLineHandler..class Plugin(DigitalBitboxPlugin):. handler = CmdLineHandler(). @hook. def init_keystore(self, keystore):. if not isinstance(keystore, self.keystore_class):. return. keystore.handler = self.handler.. def create_handler(self, window):. return self.handler.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\digitalbitbox\digitalbitbox.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):32787
                                                                                                                                                                                                                      Entropy (8bit):4.5602859394966755
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:CuqD+/3dlB3r92cNM+QbBR5pF1ohL0ET/8/snK/+JFVWn9OxhEaDmXLiJzcaVCRl:CfwDFr3IpUOsnKeFwnbL36bt7sfafM
                                                                                                                                                                                                                      MD5:B7051A3F11741AB137504C97C06BDEE6
                                                                                                                                                                                                                      SHA1:09EB8F9F873DA6AFFE4897F968D6BC8C3C4547CE
                                                                                                                                                                                                                      SHA-256:675F51AC01C4E4A5FA0FC63346DFC3E9ECCB74832C5B4554B5A93541D9B9DC60
                                                                                                                                                                                                                      SHA-512:4BB3656BDF45F64305A87148268F867AB8163DC4D0FB804784DBC58F36F4C714E86307F364C5BDC23C2BAEE020EC2B67D5785EBFC5F2E160B6951D9145F98857
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:# ----------------------------------------------------------------------------------.# Electrum plugin for the Digital Bitbox hardware wallet by Shift Devices AG.# digitalbitbox.com.#..import base64.import binascii.import hashlib.import hmac.import json.import math.import os.import re.import struct.import sys.import time.import copy.from typing import TYPE_CHECKING, Optional..from electrum.crypto import sha256d, EncodeAES_bytes, DecodeAES_bytes, hmac_oneshot.from electrum.bitcoin import public_key_to_p2pkh.from electrum.bip32 import BIP32Node, convert_bip32_intpath_to_strpath, is_all_public_derivation.from electrum.bip32 import normalize_bip32_derivation.from electrum import descriptor.from electrum import ecc.from electrum.ecc import msg_magic.from electrum.wallet import Standard_Wallet.from electrum import constants.from electrum.transaction import Transaction, PartialTransaction, PartialTxInput, Sighash.from electrum.i18n import _.from electrum.keystore import Hardware_KeyStore.from

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\digitalbitbox\qt.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3917
                                                                                                                                                                                                                      Entropy (8bit):4.690719249837408
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:j3rmoVL0OH4FFmOxJMCzJ0OOb8rNo+th5yfKOvdRBTOkttRtT58YyCawfjHwd80k:jbmU0dMCV0aR77yVV1ttzTvaqTZXSZq
                                                                                                                                                                                                                      MD5:A6DDE05E304B8218F0016BBA47BA0DB2
                                                                                                                                                                                                                      SHA1:C05FFF43F9E8C5E803FB3A7CA552A3B945EA8E94
                                                                                                                                                                                                                      SHA-256:34E29A7E9D26DA850F634BF97F82C74A925C31369ADF1C55AFE4390F25443E4F
                                                                                                                                                                                                                      SHA-512:8114478507BFC4CD3E4D47B8F485F84EDD660E8BE94F3BC3C98578718CAEDF8386C1451EA7DDF826A05FB69CD0CCC721FB0F3E83D6087BB3F268C8438FBAB0AD
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:import threading.from functools import partial.from typing import TYPE_CHECKING..from PyQt5.QtCore import pyqtSignal..from electrum.i18n import _.from electrum.plugin import hook.from electrum.wallet import Standard_Wallet, Abstract_Wallet.from electrum.util import UserCancelled, UserFacingException..from electrum.plugins.hw_wallet.qt import QtHandlerBase, QtPluginBase.from electrum.plugins.hw_wallet.plugin import only_hook_if_libraries_available, OperationCancelled..from electrum.gui.qt.wizard.wallet import WCScriptAndDerivation, WCHWXPub, WCHWUnlock..from .digitalbitbox import DigitalBitboxPlugin, DeviceErased..if TYPE_CHECKING:. from electrum.gui.qt.wizard.wallet import QENewWalletWizard...class Plugin(DigitalBitboxPlugin, QtPluginBase):. icon_unpaired = "digitalbitbox_unpaired.png". icon_paired = "digitalbitbox.png".. def create_handler(self, window):. return DigitalBitbox_Handler(window).. @only_hook_if_libraries_available. @hook. def receive_menu(self,

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\hw_wallet\__init__.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):111
                                                                                                                                                                                                                      Entropy (8bit):4.457214322966268
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3:1LVepMIgBi6MC8EwnN/sunV1HZGYM0FbQ5k0tiBin:1LVMMIiR8EU/JxZnJQ5IU
                                                                                                                                                                                                                      MD5:52B30DA28E218397BF0F197CD012BFE4
                                                                                                                                                                                                                      SHA1:682C77DD610B00FEB531C9229DFD06597E31D056
                                                                                                                                                                                                                      SHA-256:43DC75F64615B1D390CDE8CE4367AF134CA91910EB9C93FE821F83DACB3BC893
                                                                                                                                                                                                                      SHA-512:B4C9074A5E8CB05F2CA92112113BC3246E72E80EDD30C212CEA051F2E361597F1BB468DE07B8C889DF961F067DD6E447C65EFC78C75D265284753127BE1FFBB1
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from .plugin import HW_PluginBase, HardwareClientBase, HardwareHandlerBase.from .cmdline import CmdLineHandler.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\hw_wallet\cmdline.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1354
                                                                                                                                                                                                                      Entropy (8bit):4.514970029818741
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:1VZL3NbAa0G4tFi6qXVnDsUlQsXv1rZXrxT:Ll0TelnBXZ7xT
                                                                                                                                                                                                                      MD5:31CBDC01F67F32923C164021DAAFBA02
                                                                                                                                                                                                                      SHA1:BE5E95880A57BA0752399391354594D4EEE26EDB
                                                                                                                                                                                                                      SHA-256:49FF231904D9153C4DEFD35024A69B111E05859D20B8B96C4DB7E6988C46DEDC
                                                                                                                                                                                                                      SHA-512:8E479BAB7A053FA6A518AA8D925B7C590029866E4A3474A8630A8AD358F3745CF57AEF59B888C1B72DEE6B3A5861514158BDB7983A19257F4D524A645E2788F0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from electrum.util import print_stderr, raw_input.from electrum.logging import get_logger..from .plugin import HardwareHandlerBase..._logger = get_logger(__name__)...class CmdLineHandler(HardwareHandlerBase):.. def get_passphrase(self, msg, confirm):. import getpass. print_stderr(msg). return getpass.getpass('').. def get_pin(self, msg, *, show_strength=True):. t = {'a':'7', 'b':'8', 'c':'9', 'd':'4', 'e':'5', 'f':'6', 'g':'1', 'h':'2', 'i':'3'}. print_stderr(msg). print_stderr("a b c\nd e f\ng h i\n-----"). o = raw_input(). try:. return ''.join(map(lambda x: t[x], o)). except KeyError as e:. raise Exception("Character {} not in matrix!".format(e)) from e.. def prompt_auth(self, msg):. import getpass. print_stderr(msg). response = getpass.getpass(''). if len(response) == 0:. return None. return response.. def yes_no_question(self, msg):.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\hw_wallet\plugin.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):14828
                                                                                                                                                                                                                      Entropy (8bit):4.752524911800716
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:qdwQHddv9pE4nGha4ZDSFDAS67yJO4vCKbewqpcyT2fPWnO/IN20SBjq:roFvG/DovJVdK2m1NO2
                                                                                                                                                                                                                      MD5:4961B8C84883E8668B0A1E2870BF6C9A
                                                                                                                                                                                                                      SHA1:31FD90FE0C1BB917C43169545C5601B12C7B4027
                                                                                                                                                                                                                      SHA-256:05B583AF1AAAB88A008BF0D30EF6713875605CFFB93BDD0C435D91FD785414AD
                                                                                                                                                                                                                      SHA-512:52B6475FE55BD9B3AA7E5B71DCD79880EC0FFF37670CE2FA403571EE1654803C41BDE627C78B504E99F1A234E2AD7111FE05FF022C8FBDA14AABBA52DC9D1BE6
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:#!/usr/bin/env python2.# -*- mode: python -*-.#.# Electrum - lightweight Bitcoin client.# Copyright (C) 2016 The Electrum developers.#.# Permission is hereby granted, free of charge, to any person.# obtaining a copy of this software and associated documentation files.# (the "Software"), to deal in the Software without restriction,.# including without limitation the rights to use, copy, modify, merge,.# publish, distribute, sublicense, and/or sell copies of the Software,.# and to permit persons to whom the Software is furnished to do so,.# subject to the following conditions:.#.# The above copyright notice and this permission notice shall be.# included in all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY C

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\hw_wallet\qt.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):12498
                                                                                                                                                                                                                      Entropy (8bit):4.757921295230046
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:fdwQHdEXHvK0ceFB/KKMDcsfJ+Fkclm82FE8:moaXhFB/WDGFkX82+8
                                                                                                                                                                                                                      MD5:53D4E492727BAD18D344E2CC928102BE
                                                                                                                                                                                                                      SHA1:8D55EF3E4620EC8161C22CA1273B05CAD78434E2
                                                                                                                                                                                                                      SHA-256:0B33414FC749DE7F7D36E5B46DE6DF6E90BC6B74EB84D32CE911D77A1E74852E
                                                                                                                                                                                                                      SHA-512:D63345E2EAE2624C3E35A95E2193EE1B2ED3DAFD8DB9F4B0D0BA9171533F7446CFE37DCC9D9EF1D988156852C46E405EE349E565F40DCEAFD488C6E484025830
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:#!/usr/bin/env python3.# -*- mode: python -*-.#.# Electrum - lightweight Bitcoin client.# Copyright (C) 2016 The Electrum developers.#.# Permission is hereby granted, free of charge, to any person.# obtaining a copy of this software and associated documentation files.# (the "Software"), to deal in the Software without restriction,.# including without limitation the rights to use, copy, modify, merge,.# publish, distribute, sublicense, and/or sell copies of the Software,.# and to permit persons to whom the Software is furnished to do so,.# subject to the following conditions:.#.# The above copyright notice and this permission notice shall be.# included in all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY C

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\jade\__init__.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):268
                                                                                                                                                                                                                      Entropy (8bit):4.8235012599608265
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:1YvQ7rhkAtml6IFwoGSXBnAJaCwKNQo6KcB4WGVrIeCM7in:1YvQJU6VoHB+a/2cBBGV0dM+n
                                                                                                                                                                                                                      MD5:94FF5D020EE819D7986259DC69CBE476
                                                                                                                                                                                                                      SHA1:CB9E3A7C1955A5836299F31ABCC6447B0C9F059C
                                                                                                                                                                                                                      SHA-256:95C1142F731D619652DB103AB62EE229635073CBEE3878804458B1DD9D1359CF
                                                                                                                                                                                                                      SHA-512:D0F0B7A192FD2F7927445E48842C8C9041BCBC0E8CB122F30A3539BC86D10A46FD3962588C38629B3E64D305D06AFFF087E7F06CBEEC190A6E45A326ABEFBAA8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from electrum.i18n import _..fullname = 'Blockstream Jade Wallet'.description = 'Provides support for the Blockstream Jade hardware wallet'.#requires = [('', 'github.com/')].registers_keystore = ('hardware', 'jade', _("Jade wallet")).available_for = ['qt', 'cmdline'].

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\jade\cmdline.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):392
                                                                                                                                                                                                                      Entropy (8bit):4.463179374677607
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:1KM82Jco7+85zO2Hvsb/aCTATSvehahBNA099a/:1/46Hvsb/aC9sahfA0y/
                                                                                                                                                                                                                      MD5:F5C6F4BA4953FAFB51A4B7114E9F1D6D
                                                                                                                                                                                                                      SHA1:6D4D4029C28416520D82788C72FC9018510697CF
                                                                                                                                                                                                                      SHA-256:89FF53B27FE9B3308E8713925EF92B92C4896196134D9EF1F9FFA78C1AF0D83A
                                                                                                                                                                                                                      SHA-512:D4A6C9340E7CB9B6CBE4B7F82E2D9FFA026A24B98F47D088F406AC185B19A584BB1DDB91FB11916F66D5D5FB6A628E7B3E8FB9EB73429C17DD58E0E401BDBAD8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from electrum.plugin import hook.from .jade import JadePlugin.from ..hw_wallet import CmdLineHandler..class Plugin(JadePlugin):. handler = CmdLineHandler(). @hook. def init_keystore(self, keystore):. if not isinstance(keystore, self.keystore_class):. return. keystore.handler = self.handler.. def create_handler(self, window):. return self.handler.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\jade\jade.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Objective-C source, ASCII text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):20012
                                                                                                                                                                                                                      Entropy (8bit):4.605564270785093
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:0pjCMMNzjZxMYDVKnP0dCHfHElhTu8HPHlRN5tD9c/cnEYPlNDc9GR8JDq+mHLVu:1F9PHxiCEoM9GR8kceuXd829mBQ
                                                                                                                                                                                                                      MD5:F9D7283439EB46A7F3E2BB0B16F5A552
                                                                                                                                                                                                                      SHA1:F0D4A307EF71421957411B28F2E16B45AC419989
                                                                                                                                                                                                                      SHA-256:F21458090D738DB78BE55AEF43F4EB4827FF570604E21878736C9A014116190A
                                                                                                                                                                                                                      SHA-512:F0F9E16E9248DB189B8B86141FEDB89CE38328CACCA8421EFCF05EC27A17071994F3DC5C52B45EA885288F3223D2F14D34BEEDBB99F5C08EF8E63013FBEC54AE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:import os.import base64.import json.from typing import Optional, TYPE_CHECKING..from electrum import bip32, constants.from electrum.crypto import sha256.from electrum.i18n import _.from electrum.keystore import Hardware_KeyStore.from electrum.transaction import Transaction.from electrum.wallet import Multisig_Wallet.from electrum.util import UserFacingException.from electrum.logging import get_logger.from electrum.plugin import runs_in_hwd_thread, Device.from electrum.network import Network..from electrum.plugins.hw_wallet import HW_PluginBase, HardwareClientBase.from electrum.plugins.hw_wallet.plugin import OutdatedHwFirmwareException..if TYPE_CHECKING:. from electrum.plugin import DeviceInfo. from electrum.wizard import NewWalletWizard.._logger = get_logger(__name__)..#import logging.#LOGGING = logging.INFO.#if LOGGING:.# logger = logging.getLogger('jade').# logger.setLevel(LOGGING).# device_logger = logging.getLogger('jade-device').# device_logger.setLevel(LOGGING)

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\jade\jadepy\README.md

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):477
                                                                                                                                                                                                                      Entropy (8bit):4.828758399992962
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:lNQvTNJMaRaEFezANBFkN7+8yC1hGQ7VWzFs9zBYo:lyvTyqNXkNCfCCiyOVBR
                                                                                                                                                                                                                      MD5:BBAE11EC4E80905B2DC6C680164982BA
                                                                                                                                                                                                                      SHA1:3C5BA3FF27A042012A7CB8463607DEACD2E2B0A5
                                                                                                                                                                                                                      SHA-256:40B72367D9FD8D0FD510349AA25DC9863710E8DBB41BF9277893DBE161B4F604
                                                                                                                                                                                                                      SHA-512:8141EB27C201A08B4A7A7ED7F3ADA0FA73308CE03506304746CCA44346F6252ECDC8D469C0ACA88437473CC1784F52FAF050A180F167616BF3C9B5135E705654
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:# Python Jade Library..This is a slightly modified version of the official [Jade](https://github.com/Blockstream/Jade) python library...This modified version was made from tag [0.1.37](https://github.com/Blockstream/Jade/releases/tag/0.1.37)...Intention is to fold these modifications back into Jade repo, for future api release...## Changes.- Removed BLE module, reducing transitive dependencies.- _http_request() function removed, so cannot be used as unintentional fallback.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\jade\jadepy\__init__.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):83
                                                                                                                                                                                                                      Entropy (8bit):4.356008886282579
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3:1LPHJivNDZLP4XYXRvSw1AXLvHd:1LPcvRZLP4qvSw129
                                                                                                                                                                                                                      MD5:F8686A13EDF81D1653C8645C5EBE4F20
                                                                                                                                                                                                                      SHA1:E071EFD7E0EFA22DE7605157591C2B242B96315E
                                                                                                                                                                                                                      SHA-256:DBAE5D8E80228D433FB80C02750AE17B0D329F6DCCFB880775A4794530CE4517
                                                                                                                                                                                                                      SHA-512:7F600D316486ED3E7AD937021B92B3B1FBD9CE7E8FBFAC6ED901DB60481C493F05CE9E007CD46760EFF693C44CCFAB5D5D5FA581F85DF876F54CADCF8185593D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from .jade import JadeAPI.from .jade_error import JadeError..__version__ = "0.2.0".

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\jade\jadepy\jade.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):64432
                                                                                                                                                                                                                      Entropy (8bit):4.327765303621077
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:vVg7UNS+9V0PT4b19FiNDqFe5Nn5AIfY5wIfF5Qp4q:vVgIN99VNh9FiZqFe5NN4gV
                                                                                                                                                                                                                      MD5:F58D2AC5106B248A7DDD05C7759073C0
                                                                                                                                                                                                                      SHA1:FD2150CB63CEE5A52A6C5CA479660D1EBE36B9A7
                                                                                                                                                                                                                      SHA-256:A981E1E8162FD74FC5FCCF8E810600D7F939456D51F483FC892C012A1672DDC1
                                                                                                                                                                                                                      SHA-512:22FF19BB3DDDA659FED41162D5A5CF3629565B34134A020F42C0FBD4A2C3019539BE9635866547443281F804F12C23FF6D684DAA1F06433E0332184B892E09A3
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:import cbor.import hashlib.import json.import time.import logging.import collections.import collections.abc.import traceback.import random.import sys..# JadeError.from .jade_error import JadeError..# Low-level comms backends.from .jade_serial import JadeSerialImpl.from .jade_tcp import JadeTCPImpl..# 'jade' logger.logger = logging.getLogger('jade').device_logger = logging.getLogger('jade-device')..# BLE comms backend is optional.# It relies on the BLE dependencies being available.try:. from .jade_ble import JadeBleImpl.except ImportError as e:. logger.warn(e). logger.warn('BLE scanning/connectivity will not be available')...# Default serial connection.DEFAULT_SERIAL_DEVICE = '/dev/ttyUSB0'.DEFAULT_BAUD_RATE = 115200.DEFAULT_SERIAL_TIMEOUT = 120..# Default BLE connection.DEFAULT_BLE_DEVICE_NAME = 'Jade'.DEFAULT_BLE_SERIAL_NUMBER = None.DEFAULT_BLE_SCAN_TIMEOUT = 60...def _hexlify(data):. """. Helper to map bytes-like types into hex-strings. to make for prettier message

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\jade\jadepy\jade_error.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):655
                                                                                                                                                                                                                      Entropy (8bit):4.853248167454973
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:ircH+wToOd/kVka5OE1IZtsNXOXGk7O+3Lp1ASpBmkQbnDBVFHwBobLClWi5PJQ:eOoOdxa5o2NWL3HAJDnjRfCt5m
                                                                                                                                                                                                                      MD5:57A66152722C693FA838635A8E12EB69
                                                                                                                                                                                                                      SHA1:6480550846EFE74DBBDE6443EB7E119932F6D523
                                                                                                                                                                                                                      SHA-256:A50A952A33A1924CC9E26FE465270ECFCB21E3D5F55FF3B3E69E697BD0790CBD
                                                                                                                                                                                                                      SHA-512:04B401EDB9DC82F6DA202E56BEC6685754797AB915E9DFB6710C21FC2E32D22D0FA8FAC7F0E3FF49CDD65D9404106078EF97C74621A87B53754EB3B7E2DE403E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:class JadeError(Exception):. # RPC error codes. INVALID_REQUEST = -32600. UNKNOWN_METHOD = -32601. BAD_PARAMETERS = -32602. INTERNAL_ERROR = -32603.. # Implementation specific error codes: -32000 to -32099. USER_CANCELLED = -32000. PROTOCOL_ERROR = -32001. HW_LOCKED = -32002. NETWORK_MISMATCH = -32003.. def __init__(self, code, message, data):. self.code = code. self.message = message. self.data = data.. def __repr__(self):. return "JadeError: " + str(self.code) + " - " + self.message \. + " (Data: " + repr(self.data) + ")".. def __str__(self):. return repr(self).

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\jade\jadepy\jade_serial.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1719
                                                                                                                                                                                                                      Entropy (8bit):4.284181398969408
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:YZ7GafD6PkJwxgEpIXZCjSajDSajVaLcz:LC6+wKskwjSaPSa5awz
                                                                                                                                                                                                                      MD5:48DE05574E7E6DE8D3D0990428D7E94B
                                                                                                                                                                                                                      SHA1:68FA3F5AAD2FA331238C4795AA3054E2339425B9
                                                                                                                                                                                                                      SHA-256:47DA513BE9E08FDE1EBADFC838076DCBA7CAE41984A26AAE94F8A3AA2C3DD89C
                                                                                                                                                                                                                      SHA-512:71416B58AC9BF3F61DB6EF521CED767004106CA2C198D0BC712B51E97399BA9B20500ADD8791129976EB61F3AE5D271530C46DD0B64F786A9B13749A1E5B9665
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:import serial.import logging...logger = logging.getLogger('jade.serial')...#.# Low-level Serial backend interface to Jade.# Calls to send and receive bytes over the interface..# Intended for use via JadeInterface wrapper..#.# Either:.# a) use via JadeInterface.create_serial() (see JadeInterface).# (recommended).# or:.# b) use JadeSerialImpl() directly, and call connect() before.# using, and disconnect() when finished,.# (caveat cranium).#.class JadeSerialImpl:. def __init__(self, device, baud, timeout):. self.device = device. self.baud = baud. self.timeout = timeout. self.ser = None.. def connect(self):. assert self.ser is None.. logger.info('Connecting to {} at {}'.format(self.device, self.baud)). self.ser = serial.Serial(self.device, self.baud,. timeout=self.timeout,. write_timeout=self.timeout). assert self.ser is not None.. if not self.ser.is_op

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\jade\jadepy\jade_tcp.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1614
                                                                                                                                                                                                                      Entropy (8bit):4.688017869326973
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:pPOaVpKF8JP3B1fSlxA8ECKn5mYcgvYD0fAh7ud:pGafDJPHSLnPKn56JD2Acd
                                                                                                                                                                                                                      MD5:04902DD3076851784F625B8DE25673A7
                                                                                                                                                                                                                      SHA1:3A7F1C73E4D23D2C24157ED3019ECD7CEC474A65
                                                                                                                                                                                                                      SHA-256:EA7F58EE7D9C0B74552F722FB987A33412362BE985F650E13F029BFA19BB5711
                                                                                                                                                                                                                      SHA-512:D66DF02360C17144E3B9CD49E3A2E5C73C038A7BE348878C7F07FBEF271973EE9888674ECDC613879F9D472080D2BBC1E986B92E4E62B2EA828381BB381B7072
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:import socket.import logging...logger = logging.getLogger('jade.tcp')...#.# Low-level Serial-via-TCP backend interface to Jade.# Calls to send and receive bytes over the interface..# Intended for use via JadeInterface wrapper..#.# Either:.# a) use via JadeInterface.create_serial() (see JadeInterface).# (recommended).# or:.# b) use JadeTCPImpl() directly, and call connect() before.# using, and disconnect() when finished,.# (caveat cranium).#.class JadeTCPImpl:. PROTOCOL_PREFIX = 'tcp:'.. @classmethod. def isSupportedDevice(cls, device):. return device is not None and device.startswith(cls.PROTOCOL_PREFIX).. def __init__(self, device):. assert self.isSupportedDevice(device). self.device = device. self.tcp_sock = None.. def connect(self):. assert self.isSupportedDevice(self.device). assert self.tcp_sock is None.. logger.info('Connecting to {}'.format(self.device)). self.tcp_sock = socket.socket(socket.AF_INET, so

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\jade\qt.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1957
                                                                                                                                                                                                                      Entropy (8bit):4.929104544059974
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:GrmoSFmmxbjC6uT0OOvCr/3P5yfKwvdRBRWSBhtR5qvT:Emhju0UDByBXBBhtnqb
                                                                                                                                                                                                                      MD5:C7BD3F19C3E127B8E80154D13C5D1AC6
                                                                                                                                                                                                                      SHA1:F572850A7796535350168B0DED273601CB8D2A22
                                                                                                                                                                                                                      SHA-256:9EB8DC82A40FFA87E6FE4E0BAA078300DBE99C1E3E0A0C564B0A243311A849E3
                                                                                                                                                                                                                      SHA-512:59FD1AE49AAC47B9ABD421EAB8E92C9DB7E66F87DB35DE1EBADBE0F8BC4C934E43A3753F43F5D09E50F99BF03D05931AED6FA7BAA8A2B64E5DFC1976B150C108
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from functools import partial.from typing import TYPE_CHECKING..from PyQt5.QtCore import pyqtSignal..from electrum.i18n import _.from electrum.plugin import hook.from electrum.wallet import Standard_Wallet..from electrum.plugins.hw_wallet.qt import QtHandlerBase, QtPluginBase.from electrum.plugins.hw_wallet import plugin.from electrum.gui.qt.wizard.wallet import WCScriptAndDerivation, WCHWUnlock, WCHWXPub, WCHWUninitialized..from .jade import JadePlugin..if TYPE_CHECKING:. from electrum.gui.qt.wizard.wallet import QENewWalletWizard...class Plugin(JadePlugin, QtPluginBase):. icon_unpaired = "jade_unpaired.png". icon_paired = "jade.png".. def create_handler(self, window):. return Jade_Handler(window).. @plugin.only_hook_if_libraries_available. @hook. def receive_menu(self, menu, addrs, wallet):. if type(wallet) is not Standard_Wallet:. return. keystore = wallet.get_keystore(). if type(keystore) == self.keystore_class and len(add

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\keepkey\__init__.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):278
                                                                                                                                                                                                                      Entropy (8bit):4.821030196603601
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:1YvQ7rh2kv6IFpy3aOtA8ocvfPiQCwKNQo6Ku1lXoWGVrIeCM7in:1YvQJ2a6IyqOtRocvfPiQ/2u1lXRGV09
                                                                                                                                                                                                                      MD5:2D76E42E310E58826CAD4056848CF239
                                                                                                                                                                                                                      SHA1:F6708F9012B5392B24BA550D9E56FC0A39E20AC6
                                                                                                                                                                                                                      SHA-256:04EDF5BBE67D915C59089E4CFA3A024C0B935D2CB79D6A1D19421D4B820F3A32
                                                                                                                                                                                                                      SHA-512:5EEA97C182C07425E10EEB7F4BAD05D6D9276D91F4874AD87B43368C24680E41C798BD1B06EFF7B8592D89C6148AF5A610C4D61C27FDD73AB363292221B16F8B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from electrum.i18n import _..fullname = 'KeepKey'.description = _('Provides support for KeepKey hardware wallet').requires = [('keepkeylib','github.com/keepkey/python-keepkey')].registers_keystore = ('hardware', 'keepkey', _("KeepKey wallet")).available_for = ['qt', 'cmdline'].

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\keepkey\client.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):528
                                                                                                                                                                                                                      Entropy (8bit):4.608127851066862
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:1ti9PRXZI6ZVc0F2PVcoI90x1AF9AJnIyAJ9cDA6Jn4YJIAKgcVPf:1tiLpBF2PVsuAF9APAbYA6JnPif
                                                                                                                                                                                                                      MD5:737BCE725B560E515F20EB78E709C52B
                                                                                                                                                                                                                      SHA1:1B80436158FCD7C20E94E9F524DD8149FCBA9F4F
                                                                                                                                                                                                                      SHA-256:CEF7C998629FA73AD4CF51F0F1DFA58446E1369DFEAA19FBDA87097CA42D1B6B
                                                                                                                                                                                                                      SHA-512:592BFB18211BDE040FCD8CEA13F06A28142059B1C0D43649EC62C92CC9469C8148300AF1E34BA0AEBA1F0F06B0D4B5E8CB2E6EDD2E385023D2A8EE89200CDFD9
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from keepkeylib.client import proto, BaseClient, ProtocolMixin.from .clientbase import KeepKeyClientBase..class KeepKeyClient(KeepKeyClientBase, ProtocolMixin, BaseClient):. def __init__(self, transport, handler, plugin):. BaseClient.__init__(self, transport). ProtocolMixin.__init__(self, transport). KeepKeyClientBase.__init__(self, handler, plugin, proto).. def recovery_device(self, *args):. ProtocolMixin.recovery_device(self, False, *args)...KeepKeyClientBase.wrap_methods(KeepKeyClient).

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\keepkey\clientbase.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):10023
                                                                                                                                                                                                                      Entropy (8bit):4.498583976268572
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:C4ttM/vCo5J11DkuY6yAlvegqD2B0oyCGOyiwvt:3tEvM40D2WoyDXb
                                                                                                                                                                                                                      MD5:4969BD8849EE7B2BB2B86C6866616FAE
                                                                                                                                                                                                                      SHA1:3D749ABD433B407A577752520CB781A3A68FD043
                                                                                                                                                                                                                      SHA-256:A267A398D357E2FE3D31C10E975716913924561A0FCA029AFED309A305DE3508
                                                                                                                                                                                                                      SHA-512:C81DB92B001AAC7C9C9853E978BF589A60AFE476659ABF0922ECF6ADC7A9560A74C8D7A4CC0A917600897AD6291C63DD3A557C5C2B983C0F5C1AEF3652FFDC72
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:import time.from struct import pack.from typing import Optional..from electrum import ecc.from electrum.i18n import _.from electrum.util import UserCancelled.from electrum.keystore import bip39_normalize_passphrase.from electrum.bip32 import BIP32Node, convert_bip32_strpath_to_intpath.from electrum.logging import Logger.from electrum.plugin import runs_in_hwd_thread.from electrum.plugins.hw_wallet.plugin import HardwareClientBase, HardwareHandlerBase...class GuiMixin(object):. # Requires: self.proto, self.device. handler: Optional[HardwareHandlerBase].. messages = {. 3: _("Confirm the transaction output on your {} device"),. 4: _("Confirm internal entropy on your {} device to begin"),. 5: _("Write down the seed word shown on your {}"),. 6: _("Confirm on your {} that you want to wipe it clean"),. 7: _("Confirm on your {} device the message to sign"),. 8: _("Confirm the total amount spent and the transaction fee on your ". "{

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\keepkey\cmdline.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):401
                                                                                                                                                                                                                      Entropy (8bit):4.468576579494682
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:1KM82T6ZVE+857AAyn2Hvsb/aCTATSvehahBNA099a/:1/TSzw82Hvsb/aC9sahfA0y/
                                                                                                                                                                                                                      MD5:30E746E99CABA2DD38EFBF677668B08C
                                                                                                                                                                                                                      SHA1:728CF6052FCBD8505FF30DEB811338099A11BAE3
                                                                                                                                                                                                                      SHA-256:572B3024F467EB5606F89D7C48C72005178537A1D8AA4BD18008A2AED2A0826F
                                                                                                                                                                                                                      SHA-512:930011E39A6C68E6D367292D009D2CEF37927BDBE732DE579D42E86305CE60DF4132689D9EAC0A9E15E5F15C261D3000222B5997599506C0B03C7F49DEF2B91E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from electrum.plugin import hook.from .keepkey import KeepKeyPlugin.from ..hw_wallet import CmdLineHandler..class Plugin(KeepKeyPlugin):. handler = CmdLineHandler(). @hook. def init_keystore(self, keystore):. if not isinstance(keystore, self.keystore_class):. return. keystore.handler = self.handler.. def create_handler(self, window):. return self.handler.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\keepkey\keepkey.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):18435
                                                                                                                                                                                                                      Entropy (8bit):4.497557488972594
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:4InEP87YTnl+DaeGInJq7ZBQUQmAUo3h4qbIOvlzoVOD7ZwcPnCkjVCK5P+F1J:REE7Yl+wA3IOX3Wgnp0EK
                                                                                                                                                                                                                      MD5:3179FED1DC739CB21AB7567C24A1CDD4
                                                                                                                                                                                                                      SHA1:075756B8A4F620F526A11B13D82BE761AAC668A1
                                                                                                                                                                                                                      SHA-256:F7DF6248C7C7E305189975C2B1200BCE781527DA6CE8EB5E7B4EAB6D36805756
                                                                                                                                                                                                                      SHA-512:FFC1D27D3C1BEA3EBE4C82A772E70AC36DB061E42C1BB89AA616421AC7CEE7B0FA1453CFAAD989CADBA642FF06BE4230971185FFBF16D1CAD5E45F412A51D390
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from typing import Optional, TYPE_CHECKING, Sequence..from electrum.util import UserFacingException.from electrum.bip32 import BIP32Node.from electrum import descriptor.from electrum import constants.from electrum.i18n import _.from electrum.transaction import Transaction, PartialTransaction, PartialTxInput, Sighash.from electrum.keystore import Hardware_KeyStore.from electrum.plugin import Device, runs_in_hwd_thread..from ..hw_wallet import HW_PluginBase.from ..hw_wallet.plugin import is_any_tx_output_on_change_branch, trezor_validate_op_return_output_and_get_data..if TYPE_CHECKING:. import usb1. from .client import KeepKeyClient. from electrum.plugin import DeviceInfo. from electrum.wizard import NewWalletWizard...# TREZOR initialization methods.TIM_NEW, TIM_RECOVER, TIM_MNEMONIC, TIM_PRIVKEY = range(0, 4)...class KeepKey_KeyStore(Hardware_KeyStore):. hw_type = 'keepkey'. device = 'KeepKey'.. plugin: 'KeepKeyPlugin'.. def decrypt_message(self, sequence, messag

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\keepkey\qt.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):29123
                                                                                                                                                                                                                      Entropy (8bit):4.644533633229949
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:LbK1gtqeyIERy5vVSjlmmvi4wJa4z1xKXxVIz:LbKeRyIERy59SjlmSi4Ma4z1xKXT0
                                                                                                                                                                                                                      MD5:28A6682EC9A4BC4590A28DCA6E01A9D4
                                                                                                                                                                                                                      SHA1:D34C9E90D74B75C7BB261E3DD76171799A79C220
                                                                                                                                                                                                                      SHA-256:71EAE26CA283109E3F98D9757A72D4CA82ACBC7F86B998BD293DB2A0A85D5856
                                                                                                                                                                                                                      SHA-512:A20EB7B082AEDADF88EF77CF1ACE3D48F4D254FB35AE833438C5003CAAEF0DF20C44B0AC01211599488D6A75CD758F53FC2FE9B9943D62FAF886E7042A8401CE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:import threading.from functools import partial.from typing import TYPE_CHECKING..from PyQt5.QtCore import Qt, QEventLoop, pyqtSignal, QRegExp.from PyQt5.QtGui import QRegExpValidator.from PyQt5.QtWidgets import (QVBoxLayout, QLabel, QGridLayout, QPushButton,. QHBoxLayout, QButtonGroup, QGroupBox, QDialog,. QTextEdit, QLineEdit, QRadioButton, QCheckBox, QWidget,. QMessageBox, QSlider, QTabWidget)..from electrum.gui.qt.util import (WindowModalDialog, WWLabel, Buttons, CancelButton,. OkButton, CloseButton, ChoiceWidget).from electrum.i18n import _.from electrum.plugin import hook.from electrum.logging import Logger..from ..hw_wallet.qt import QtHandlerBase, QtPluginBase.from ..hw_wallet.plugin import only_hook_if_libraries_available.from .keepkey import KeepKeyPlugin, TIM_NEW, TIM_RECOVER, TIM_MNEMONIC, TIM_PRIVKEY..from electrum.gui.qt.wizard.wallet import WCScriptAndDeriv

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\labels\Labels.qml

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):976
                                                                                                                                                                                                                      Entropy (8bit):4.266424000445255
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:I60KUhGhBlgaXgne6DqtnRIqmAzA1cmPcr4c1UL:I60KUhGblh16Otnv3k1re4XL
                                                                                                                                                                                                                      MD5:63333160BA67AB698C70BDA33EB05C36
                                                                                                                                                                                                                      SHA1:0EC3C196CF478AA9DA3BA909E0E748492E4DF860
                                                                                                                                                                                                                      SHA-256:D61F0650C154C214B5235DC7AA6D75435B25C3642E1E84823BEA864493F5B741
                                                                                                                                                                                                                      SHA-512:4E5D76DF424F2A4E0249F8198DA0531B1A3F326D16A4FF567896FFE7AE1236E895B56877A24C572169C490426E82E834AB81677225DB624FEEC89D9FF2F865A9
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:import QtQuick 2.6.import QtQuick.Layouts 1.0.import QtQuick.Controls 2.14.import QtQuick.Controls.Material 2.0..import org.electrum 1.0..//import "controls"..Item {. width: parent.width. height: rootLayout.height.. property QtObject plugin.. RowLayout {. id: rootLayout. Button {. text: 'Force upload'. enabled: !plugin.busy. onClicked: plugin.upload(). }. Button {. text: 'Force download'. enabled: !plugin.busy. onClicked: plugin.download(). }. }.. Connections {. target: plugin. function onUploadSuccess() {. console.log('upload success'). }. function onUploadFailed() {. console.log('upload failed'). }. function onDownloadSuccess() {. console.log('download success'). }. function onDownloadFailed() {. console.log('download failed'). }. }.}.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\labels\__init__.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):353
                                                                                                                                                                                                                      Entropy (8bit):4.662360886198234
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:1YvQ7rhtg9bOsxY3/PbdoBdkAFcmFkM/AYXMDGeh0or1fmCFfgy3mPGVrIeCRI4/:1YvQJ+Rxco0AmmFFvMD/2aeUfiGV0dRn
                                                                                                                                                                                                                      MD5:21448A626D1CD28546563118CA9AC337
                                                                                                                                                                                                                      SHA1:ED3E2C021DD395DE0E6C882DCF99E9F243B14D35
                                                                                                                                                                                                                      SHA-256:A70D9912CC5E610131698A3A38961DD66C735D831A833BEBD7058C50E3CDC112
                                                                                                                                                                                                                      SHA-512:BC12ABB6B649D5A786A4CA2AA8A2AEBD48CFC944D7DD99A37438FC9AC09DD8F0F371762365411141A1003B8B673811FF8D980C19CF4985BE69BA03142FD767D7
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from electrum.i18n import _..fullname = _('LabelSync').description = ' '.join([. _("Save your wallet labels on a remote server, and synchronize them across multiple devices where you use Electrum."),. _("Labels, transactions IDs and addresses are encrypted before they are sent to the remote server.").]).available_for = ['qt', 'qml', 'cmdline']..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\labels\cmdline.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):271
                                                                                                                                                                                                                      Entropy (8bit):4.460627159720854
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:1LJyQsOXJKMMIin4BOZCzLM0twRL0JXg3U6IaT/XhMZamv:18QuM8lp0KRUamv
                                                                                                                                                                                                                      MD5:96C7F006F00DEC601B732FC566A8C9EE
                                                                                                                                                                                                                      SHA1:031CEBAB7EAECB151C0E777A1FC4FF825638853B
                                                                                                                                                                                                                      SHA-256:3DC8658B4F1F0FC29C6B889F94713135A9D36B5DFA05252E4D33D343E96A9974
                                                                                                                                                                                                                      SHA-512:60976A78CCC1632176E1CBAA76073014B3BBD984F6C7D8287580EEDF151C1E027EC41020BAF3E35FEB7E0D8CC7FE2519805E02A6B4F32C86A3664381DD55A798
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from .labels import LabelsPlugin.from electrum.plugin import hook..class Plugin(LabelsPlugin):.. @hook. def load_wallet(self, wallet, window):. self.start_wallet(wallet).. def on_pulled(self, wallet):. self.logger.info('labels pulled from server').

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\labels\labels.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):8160
                                                                                                                                                                                                                      Entropy (8bit):4.481185503293974
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:qfpwF+mxbhqAGWG4oPUXwzRYcYXfLUw7X3bmQHu1AnJGHVOz0Sma3d1Ko5q:qfXC8gv9vmCZcYz0k8
                                                                                                                                                                                                                      MD5:9718897C830CD910B320453624FAB3E0
                                                                                                                                                                                                                      SHA1:993297EF438553F6E77E5682F9E4FCDF685743C3
                                                                                                                                                                                                                      SHA-256:96A7FA4C6244019B4B13F44982B6300179E420769A662F9A50A541035AA09757
                                                                                                                                                                                                                      SHA-512:516E0FA5010A844B2731929F8E024073530D6A517D1CA5EBB0BE3DE800CB80FC9E282F4DDAF951F279C4BFACFBD4980F6B79124659AFA6F7F23DBE2F1AFBF070
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:import asyncio.import hashlib.import json.import sys.import traceback.from typing import Union, TYPE_CHECKING..import base64..from electrum import util.from electrum.plugin import BasePlugin, hook.from electrum.crypto import aes_encrypt_with_iv, aes_decrypt_with_iv.from electrum.i18n import _.from electrum.util import log_exceptions, ignore_exceptions, make_aiohttp_session.from electrum.network import Network..if TYPE_CHECKING:. from electrum.wallet import Abstract_Wallet...class ErrorConnectingServer(Exception):. def __init__(self, reason: Union[str, Exception] = None):. self.reason = reason.. def __str__(self):. header = _("Error connecting to {} server").format('Labels'). reason = self.reason. if isinstance(reason, BaseException):. reason = repr(reason). return f"{header}: {reason}" if reason else header...class LabelsPlugin(BasePlugin):.. def __init__(self, parent, config, name):. BasePlugin.__init__(self, parent, con

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\labels\qml.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4142
                                                                                                                                                                                                                      Entropy (8bit):4.383682861028925
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:jcmMppNvgN3t97NE9q7vIbYg37QeBfBYhB:YZp1ioDRhGhB
                                                                                                                                                                                                                      MD5:080032F17E18E29FC7C25CC5B9AB1382
                                                                                                                                                                                                                      SHA1:6B1A86637A697BD9A8A63D9788C36B6954837D1D
                                                                                                                                                                                                                      SHA-256:9C436F742E50C1E7602DA5EEF3D31BDCB996A0DEBDC4531E18F7F53501DD77E5
                                                                                                                                                                                                                      SHA-512:92142E61A92FD560752531CD067A60AD220048C91A95599D4D97513D7532E705875FBCA389BBC9B698EE05907445606E8ABDC33D6F6E43F97D8C893381DC540C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:import threading..from PyQt6.QtCore import pyqtSignal, pyqtSlot..from electrum.i18n import _.from electrum.plugin import hook..from electrum.gui.qml.qewallet import QEWallet.from electrum.gui.common_qt.plugins import PluginQObject..from .labels import LabelsPlugin...class Plugin(LabelsPlugin):.. class QSignalObject(PluginQObject):. labelsChanged = pyqtSignal(). uploadSuccess = pyqtSignal(). uploadFailed = pyqtSignal(). downloadSuccess = pyqtSignal(). downloadFailed = pyqtSignal().. _name = _('LabelSync Plugin').. def __init__(self, plugin, parent):. super().__init__(plugin, parent).. @pyqtSlot(result=str). def settingsComponent(self): return '../../../plugins/labels/Labels.qml'.. @pyqtSlot(). def upload(self):. assert self.plugin.. self._busy = True. self.busyChanged.emit().. self.plugin.push_async().. def upload_finished(self, result):.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\labels\qt.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3613
                                                                                                                                                                                                                      Entropy (8bit):4.632841276996006
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:gqm6FOZvbgrjd0jbvjhX34df9xJ96X1Jp:gqhqLjh44X3p
                                                                                                                                                                                                                      MD5:31E333482CBF6401028D4CFF6E807307
                                                                                                                                                                                                                      SHA1:75F2CB9A3F425A4064057946D5D2F1C7E222ED07
                                                                                                                                                                                                                      SHA-256:5EBDD56C0E9BEAC63935D957AE145117D01F7EE0DE779C45C6D72F32FC48834F
                                                                                                                                                                                                                      SHA-512:26C95AF6EE071C1EDB8E273BC245EEA251F383D580F8B35B7E24AF5A3FE8BDC7D5F85FB4A5C0DF89E014145F1AC8B9B12F14D3914143B109024C78B9669E3887
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from functools import partial.import traceback.import sys.from typing import TYPE_CHECKING..from PyQt5.QtCore import QObject, pyqtSignal.from PyQt5.QtWidgets import (QHBoxLayout, QLabel, QVBoxLayout)..from electrum.plugin import hook.from electrum.i18n import _.from electrum.gui.qt.util import ThreadedButton, Buttons, EnterButton, WindowModalDialog, OkButton..from .labels import LabelsPlugin..if TYPE_CHECKING:. from electrum.gui.qt import ElectrumGui. from electrum.gui.qt.main_window import ElectrumWindow. from electrum.wallet import Abstract_Wallet..class QLabelsSignalObject(QObject):. labels_changed_signal = pyqtSignal(object)...class Plugin(LabelsPlugin):.. def __init__(self, *args):. LabelsPlugin.__init__(self, *args). self.obj = QLabelsSignalObject(). self._init_qt_received = False.. def requires_settings(self):. return True.. def settings_widget(self, window: WindowModalDialog):. return EnterButton(_('Settings'),.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\ledger\__init__.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):285
                                                                                                                                                                                                                      Entropy (8bit):4.84363630841645
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:1YvQ7rhqA0Opml6IFCKkJMKNzEmGgvXwKNQo6KcbJZH+WGVrIeCM7in:1YvQJqLt68/KNgt2aRGV0dM+n
                                                                                                                                                                                                                      MD5:93C97180066580C721162F2D8A58D0E8
                                                                                                                                                                                                                      SHA1:A65514D33C88A9A4EBABD81D41C93111177D75EE
                                                                                                                                                                                                                      SHA-256:D9D094304691A391B0DB294F4741C8F838B07BA821E70E98EC8AB2433AC8484B
                                                                                                                                                                                                                      SHA-512:D42647048E9CA3A597FF776A55A1D1C7FED3968826E1DF91126029A2A13A9B7930C5B66B9B3F3B2EB8F417E50895A2EB8E8983680B68B4EAEEDA407C34295B96
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from electrum.i18n import _..fullname = 'Ledger Wallet'.description = 'Provides support for Ledger hardware wallet'.requires = [('ledger_bitcoin', 'github.com/LedgerHQ/app-bitcoin-new')].registers_keystore = ('hardware', 'ledger', _("Ledger wallet")).available_for = ['qt', 'cmdline'].

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\ledger\auth2fa.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7022
                                                                                                                                                                                                                      Entropy (8bit):4.747407652681403
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:1JAljLvMF9F0tNyydkVHSMEdUoavFfbpGPQS:SjAF9F0tNyydGSMEdUoavFfbpGPQS
                                                                                                                                                                                                                      MD5:9C1C046D745D8B69FAAD6816ECC3CDC3
                                                                                                                                                                                                                      SHA1:A533767A31D529B7D474DBEFC20DFF760262C276
                                                                                                                                                                                                                      SHA-256:37AAFAF43AA20413B58BA98144BD6DD0C9D392815B7FE8768D873C8FB170A353
                                                                                                                                                                                                                      SHA-512:3464005E9FC850E9E317F4002E3D265DDB1BD54885C6FDE74D9D06F3965E333CB4068504A8C5659E2A3860327C328A74A3C5F3EE4FC8C9FE39CC584BA5AE1458
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:import copy.from typing import TYPE_CHECKING..from PyQt5.QtWidgets import (QDialog, QLineEdit, QTextEdit, QVBoxLayout, QLabel,. QWidget, QHBoxLayout, QComboBox)..from btchip.btchip import BTChipException..from electrum.gui.qt.util import PasswordLineEdit..from electrum.i18n import _.from electrum import constants, bitcoin.from electrum.logging import get_logger..if TYPE_CHECKING:. from .ledger import Ledger_Client..._logger = get_logger(__name__)...DEBUG = False..helpTxt = [_("Your Ledger Wallet wants to tell you a one-time PIN code.<br><br>" \. "For best security you should unplug your device, open a text editor on another computer, " \. "put your cursor into it, and plug your device into that computer. " \. "It will output a summary of the transaction being signed and a one-time PIN.<br><br>" \. "Verify the transaction summary and type the PIN code here.<br><br>" \. "Before pressing enter, plug the

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\ledger\cmdline.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):398
                                                                                                                                                                                                                      Entropy (8bit):4.436105371577658
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:1KM82Zaw+85vz2Hvsb/aCTATSvehahBNA099a/:1/UP+qHvsb/aC9sahfA0y/
                                                                                                                                                                                                                      MD5:6AFC46764F78CB549913211C932ABF9E
                                                                                                                                                                                                                      SHA1:AD5BBE48D36EB947D6D3BFAF629A407D8DEF8E53
                                                                                                                                                                                                                      SHA-256:F8860C9DE94C9E8058DA2B03755AE236BC0574BE21510B05B600F085CAFA5A1C
                                                                                                                                                                                                                      SHA-512:BC559EA11527864E6B9E02E3AFE93B74ED6359E2EA5558153DC5F3A3A153F1BFAD4E265242B85EF409CC7838FAF41ACFC433ABF088D0E876098CA2DDF7BE46C8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from electrum.plugin import hook.from .ledger import LedgerPlugin.from ..hw_wallet import CmdLineHandler..class Plugin(LedgerPlugin):. handler = CmdLineHandler(). @hook. def init_keystore(self, keystore):. if not isinstance(keystore, self.keystore_class):. return. keystore.handler = self.handler.. def create_handler(self, window):. return self.handler.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\ledger\ledger.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):60739
                                                                                                                                                                                                                      Entropy (8bit):4.547634742971814
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:5ud/kX6YVXmoY1UlHh2cRSOJL8rORuX/kkfShCMUlRUWaMjVuSkKKrbeANAeYc19:5udI6YVXmyHDI6d8UW7pwdF0Chfr
                                                                                                                                                                                                                      MD5:09FDFBFA65B3413360649253DFF7F224
                                                                                                                                                                                                                      SHA1:048E41B2555C8630A7A9AD5AC0AE2DAEA0F13C35
                                                                                                                                                                                                                      SHA-256:4FF95014814EEF52F85EC80E45F36E311CCEAF55F584E6E7162C0F50CE5E748B
                                                                                                                                                                                                                      SHA-512:098C6E5EF2D0C78B3BAC4FF9D18F8D8B900FF03D3A012D6C9E94023C1663B8C6573BD6F8FD63634459180BA3BE915D20C10DA7D55095A8E14FA3F4A5F494A539
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:# Some parts of this code are adapted from bitcoin-core/HWI:.# https://github.com/bitcoin-core/HWI/blob/e731395bde13362950e9f13e01689c475545e4dc/hwilib/devices/ledger.py..from abc import ABC, abstractmethod.import base64.import hashlib.from typing import Dict, List, Optional, Sequence, Tuple, TYPE_CHECKING..from electrum import bip32, constants, ecc.from electrum import descriptor.from electrum.bip32 import BIP32Node, convert_bip32_intpath_to_strpath, normalize_bip32_derivation.from electrum.bitcoin import EncodeBase58Check, int_to_hex, is_b58_address, is_segwit_script_type, var_int.from electrum.crypto import hash_160.from electrum.i18n import _.from electrum.keystore import Hardware_KeyStore.from electrum.logging import get_logger.from electrum.plugin import Device, runs_in_hwd_thread.from electrum.transaction import PartialTransaction, Transaction, PartialTxInput.from electrum.util import bfh, UserFacingException, versiontuple.from electrum.wallet import Standard_Wallet..from ..hw_w

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\ledger\qt.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3240
                                                                                                                                                                                                                      Entropy (8bit):4.769142883833306
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:CmW40QjLE0UxyM6+CnCtO2eVqQjt9O6JGEY:CrHi3UgMvJhWc
                                                                                                                                                                                                                      MD5:7E6BB8599322D1619385865EAD965C95
                                                                                                                                                                                                                      SHA1:B465F07EC88F2DF316EADC726EFC4E151C30F926
                                                                                                                                                                                                                      SHA-256:7B18956F7F0473E84373DF390A391BE2DF2059173AF6EBC16513FE67B4A2AFB0
                                                                                                                                                                                                                      SHA-512:49E806AC5BA2F25A183192FD8F2A612E57537A58D3EED458C8A5DA30F3AFB42C735B360654282B3362B9219314CF46605F0918C41968F63DB9BE5A5C27BA22CA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from functools import partial.from typing import TYPE_CHECKING..from PyQt5.QtCore import pyqtSignal.from PyQt5.QtWidgets import QInputDialog, QLineEdit..from electrum.i18n import _.from electrum.plugin import hook.from electrum.wallet import Standard_Wallet..from .ledger import LedgerPlugin, Ledger_Client.from ..hw_wallet.qt import QtHandlerBase, QtPluginBase.from ..hw_wallet.plugin import only_hook_if_libraries_available.from electrum.gui.qt.wizard.wallet import WCScriptAndDerivation, WCHWUninitialized, WCHWUnlock, WCHWXPub..if TYPE_CHECKING:. from electrum.gui.qt.wizard.wallet import QENewWalletWizard...class Plugin(LedgerPlugin, QtPluginBase):. icon_unpaired = "ledger_unpaired.png". icon_paired = "ledger.png".. def create_handler(self, window):. return Ledger_Handler(window).. @only_hook_if_libraries_available. @hook. def receive_menu(self, menu, addrs, wallet):. if type(wallet) is not Standard_Wallet:. return. keystore = wallet.g

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\__init__.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):140
                                                                                                                                                                                                                      Entropy (8bit):4.653892747944294
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3:1ApxQ2MUdLNQK0rbF6qnXMSMZnNbt/8XqXAXMNFVHv66JfWyECbCin:1YvQ7rhC/FFttAcXh3Vrmin
                                                                                                                                                                                                                      MD5:11E1D2BC564933B59B4619773B50851A
                                                                                                                                                                                                                      SHA1:76BBB12A3CE6C9A0B5218D91F55AAC0C4FC55021
                                                                                                                                                                                                                      SHA-256:2C0D9A443E5507125519D120B83E1D8FFA9E11AC4419F42B1658C1F589061D2B
                                                                                                                                                                                                                      SHA-512:A5AABA08FF268EAB6A87A5A587D28F4DB48062FBF2AE730C87594DD76C4DE703878FFBE340E584C59B7924586004EB242EDCC34F0170F6AD592A53811C37D5BB
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from electrum.i18n import _..fullname = _('PayServer').description = 'run a HTTP server for receiving payments'.available_for = ['cmdline'].

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\cmdline.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1253
                                                                                                                                                                                                                      Entropy (8bit):5.155149269351112
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:Uobk4JHWWV0yPP3VtkHe1oai9QHlsUjH8Ok46+d5Eo3DqeFUO:UEtJdVlPvLTmawQHlsyHIO5d3D1FZ
                                                                                                                                                                                                                      MD5:933102C0C6E3280EA5E125F7E91CD578
                                                                                                                                                                                                                      SHA1:3C369B1F4431537C05AD22D11CC605A3FB46448E
                                                                                                                                                                                                                      SHA-256:298CD766F61C90F233EF52FFF9BFF848894DE13A088CE856E4E47036F931FEDC
                                                                                                                                                                                                                      SHA-512:977BBBAB4C327D4BAD43579BD37D91235779C0919C83F215A1C83906AF7C601074510279261D1ED3A437A5D2FDB5160DF6A9B4FCD7D8762F636931A061A3AFC5
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:#!/usr/bin/env python.#.# Electrum - Lightweight Bitcoin Client.# Copyright (C) 2022 The Electrum Developers.#.# Permission is hereby granted, free of charge, to any person.# obtaining a copy of this software and associated documentation files.# (the "Software"), to deal in the Software without restriction,.# including without limitation the rights to use, copy, modify, merge,.# publish, distribute, sublicense, and/or sell copies of the Software,.# and to permit persons to whom the Software is furnished to do so,.# subject to the following conditions:.#.# The above copyright notice and this permission notice shall be.# included in all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LI

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\payserver.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):6788
                                                                                                                                                                                                                      Entropy (8bit):4.888160709542598
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:hdwQHdFAfunGGKumBmpbUCmwNbDo7U7D7vG8:soyuBKumBmpbUCmwbDeU7/l
                                                                                                                                                                                                                      MD5:309E5652E49734690D5958DE50680649
                                                                                                                                                                                                                      SHA1:752C61C641A377074887EF5747FDD8C56D0EEDF2
                                                                                                                                                                                                                      SHA-256:BDF81D7311BBAA677BF0692A5C9BDA0B367F3D3FEC1493254EF822DDCA8EF5DE
                                                                                                                                                                                                                      SHA-512:31B173822BCCECCA143D144F297691F91A2ACCFAD2EAB6257913F34CAA2799CCD8FA3887784EA8FA0C49C854B3EE1668BBDB6C01BE660432BE0169B4C571F494
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:#!/usr/bin/env python.#.# Electrum - Lightweight Bitcoin Client.# Copyright (C) 2022 The Electrum Developers.#.# Permission is hereby granted, free of charge, to any person.# obtaining a copy of this software and associated documentation files.# (the "Software"), to deal in the Software without restriction,.# including without limitation the rights to use, copy, modify, merge,.# publish, distribute, sublicense, and/or sell copies of the Software,.# and to permit persons to whom the Software is furnished to do so,.# subject to the following conditions:.#.# The above copyright notice and this permission notice shall be.# included in all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LI

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\.editorconfig

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):189
                                                                                                                                                                                                                      Entropy (8bit):4.603023009803555
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3:SMRVYG62mQDMOXKL1vEBALcWj2xJ6PC2o/PgdvS+xFoqq45uIaucWepMik/rJbiZ:SQVYCmQCL1vE2L6Tmw/PiqegavJiedOZ
                                                                                                                                                                                                                      MD5:57EE98C14EC81A9135983C3E84E8BDDD
                                                                                                                                                                                                                      SHA1:715BAD219BE2F9D65F82D5914CD9BBE09CF543E4
                                                                                                                                                                                                                      SHA-256:558BBCF2F0052713B6E479F4EF664E6D5ADBB31F006E42427468670682CDE2FF
                                                                                                                                                                                                                      SHA-512:EBBC49967798528CEA50663925C5BF536226A213D98122DE8357746A2B6056C4D7E2A48ED97C9E0A6B09C6D9D5674E807BBB0603B4165BBB05AB5ED70ADED1D8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:# see https://EditorConfig.org..root = true..[*].indent_style = space.trim_trailing_whitespace = true.end_of_line = lf.charset = utf-8..[*.html].indent_size = 4.insert_final_newline = true.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\.git

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):46
                                                                                                                                                                                                                      Entropy (8bit):3.801815010925754
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3:vW5yVC2gtmsAGxQ3hcn:vuteJhcn
                                                                                                                                                                                                                      MD5:DA9726D60EE6D0B3FFE8FE7E7FFDD02E
                                                                                                                                                                                                                      SHA1:926DB90A6B37528252D68254EBDA6D4439429192
                                                                                                                                                                                                                      SHA-256:05A0DB3D8D302F2CB18FDE3FBEBDFC84233AEA1118ED4FFCFE6349A1BB817C53
                                                                                                                                                                                                                      SHA-512:8AD688712BE8128C9DF39B824666F9987107B6F99F5F701FCE112651463A60DDF1F0230D2285098F8B4BD795EE12DEA010434EE665091F87A849BB6713D7370E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:gitdir: ../../../../.git/modules/electrum/www.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\.gitignore

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):6
                                                                                                                                                                                                                      Entropy (8bit):2.584962500721156
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3:M5n:M5n
                                                                                                                                                                                                                      MD5:7A8B085DBF273DE1BB2CB0B44C858F33
                                                                                                                                                                                                                      SHA1:B9C4D3CFCF0530FA5EE6EACF43499BE4B0FD0505
                                                                                                                                                                                                                      SHA-256:1D15BDB66E2D42CD0ECDDEB6926D7A97DBF7A82A055067B7B9AFC05112EE0437
                                                                                                                                                                                                                      SHA-512:D295737DD931415A0071E117C076CA606D9DDCB5760DE461B6FE2C8B884618C68F79B130FBABBA9D53E12B8132422BCCBFFFF014B4CFB4D943A00BF65D9BF229
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.idea.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\LICENCE

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1156
                                                                                                                                                                                                                      Entropy (8bit):5.135419459723763
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:TN90gMHiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:rQHiJzfPvGt7ICQH+sfIte36AFD
                                                                                                                                                                                                                      MD5:6F575409890FC5018003C9DE6F701BB3
                                                                                                                                                                                                                      SHA1:0E07954FD102EF9D14141BF3932D97F0CFFD9CAC
                                                                                                                                                                                                                      SHA-256:7E74F53B0182E34D6DBAD47308F8719E947D7A8C4AEF8CBAB35C34B46BA9DF01
                                                                                                                                                                                                                      SHA-512:0AC8598C3960D7F4221F21546B9EBE45BEA4369A9C84A56FDE7179A56D523AAF45F5903AC5B2353C394A656A83B6221920C088AF65DEAF3EB739F425FE940C8B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MIT license (as below), except for the "vendor/" library...-----..The MIT License (MIT)..Copyright (c) 2022 The Electrum developers..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\README.md

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):63
                                                                                                                                                                                                                      Entropy (8bit):4.277638551759855
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3:SstXQ1HvPET/V+LzD0FQJpjRo:SE6Hv8T/V+PD0SbjRo
                                                                                                                                                                                                                      MD5:7AB347B2A1BB62AA469491E5A3ED02CC
                                                                                                                                                                                                                      SHA1:5BD896B048174A63E9BE6EE2875A676AE381C309
                                                                                                                                                                                                                      SHA-256:7CB581F049BD841F91277080976DD973D5781E82F0C7E823FF412BCCFB87022E
                                                                                                                                                                                                                      SHA-512:CC470C5AD4541F33AB75BE3ACD47FDF7F37FF7E2EB8AA976A7E96A637457F2330428D151E82F428DEE06C5E163AE3464805484032F58338DA0AEDB917CD2AFDD
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:# electrum-http.javascript and html files for payment requests.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\create_invoice.html

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:HTML document, ASCII text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1042
                                                                                                                                                                                                                      Entropy (8bit):4.711894685746978
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:0peYbM78V8EtpWTQzJ0OEhxuBeWsb8np/gT2IA:0TMQV8ipWE0JhAABbQpIy
                                                                                                                                                                                                                      MD5:362F55B495A98401872518F374786FE5
                                                                                                                                                                                                                      SHA1:8B22154EC5105D67836BFF52CE1B2DAFD060C1A0
                                                                                                                                                                                                                      SHA-256:148C5C6C7A22704D789E3DD90AE6A722EDD14485744AE11DC6BDD04A3AC3781A
                                                                                                                                                                                                                      SHA-512:F9395336914517E21B60544AC7DC086B6BD978FAE3B72BB93B95CF6752F0487DBEBBC3D6C38E09BFBE8B250C4B77034A2CE05441383874AB0659D4892C06D898
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<!doctype html>.<html>. <head>. <meta charset="utf-8">. <style type="text/css">. body {.. font-family: Arial;. }. form {. }. input {.. border: 2px solid #ccc;.. padding: 12px 20px;. }. </style>. </head>. <body>. <div style="width:30em; margin:auto;">. <p>This is a sample web interface that lets you create on-chain..and lightning invoices to your Electrum wallet. You can use it..with an electrum daemon running on a webserver. The lightning..invoice will be replaced by an error message if your wallet is..disconnected or does not have enough inbound liquidity to..receive the requested amount. The on-chain invoice will not be..displayed if the amount is too small to be received onchain.. </p>. <form method=POST action=/api/create_invoice>..<input name="message" placeholder="description"><br/>..<input type="number" min="1" name="amount_sat" placeholder="amount (satoshis)" ><br/>..<input type="submit" value="Create invoice"><br/>.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\index.html

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:HTML document, ASCII text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):9691
                                                                                                                                                                                                                      Entropy (8bit):4.975123909216841
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:uaxDvaDsTawIOxkJsyrbzzpk5NnIJqtPB0UQKL85P6h9GfU9z8yVQ:zLSQyrbX7JqtPiA9Mj
                                                                                                                                                                                                                      MD5:1681BAE57A7EC0694F7531CF27B17A81
                                                                                                                                                                                                                      SHA1:4D2F49C78659BC2D8FC20260D8880C1A4E896B16
                                                                                                                                                                                                                      SHA-256:5DCD17868ECF8FAD6A233305B67889FE8B9F8509947D082A392AB092E0D0C3FC
                                                                                                                                                                                                                      SHA-512:1D39D107796D61F87E8D69700310F18E7D9018303AFD5BDA85A12A7BC5F2C802C3F97778F2F72AD52264076F240EDCF78C62A0D4EBB32AD7A1834AC4EB378EED
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<!DOCTYPE HTML>.<html>.<head>. <meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>. <title>Payment request</title>. <script type="text/javascript" charset="utf-8" src="vendor/jquery-3.4.1.min.js"></script>. <script type="text/javascript" src="vendor/jquery-ui.min.js"></script>. <script type="text/javascript" src="vendor/qrcode.js"></script>. <link rel="stylesheet" type="text/css". href="vendor/jquery-ui-themes-1.12.1/themes/ui-lightness/jquery-ui.css">. <style type="text/css">.. body {.. font-family: Arial;. }.. .tab {.. overflow: hidden;.. border: 1px solid #ccc;.. background-color: #f1f1f1;. }. .tab button {.. background-color: inherit;.. float: left;.. border: none;.. outline: none;.. cursor: pointer;.. padding: 14px 16px;.. transition: 0.3s;. }. .tab button:hover {.. background-color: #ddd;. }. .tab button.active {.. background-color: #ccc;. }. .tabcontent {.. display

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\pay

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:HTML document, ASCII text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):9691
                                                                                                                                                                                                                      Entropy (8bit):4.975123909216841
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:uaxDvaDsTawIOxkJsyrbzzpk5NnIJqtPB0UQKL85P6h9GfU9z8yVQ:zLSQyrbX7JqtPiA9Mj
                                                                                                                                                                                                                      MD5:1681BAE57A7EC0694F7531CF27B17A81
                                                                                                                                                                                                                      SHA1:4D2F49C78659BC2D8FC20260D8880C1A4E896B16
                                                                                                                                                                                                                      SHA-256:5DCD17868ECF8FAD6A233305B67889FE8B9F8509947D082A392AB092E0D0C3FC
                                                                                                                                                                                                                      SHA-512:1D39D107796D61F87E8D69700310F18E7D9018303AFD5BDA85A12A7BC5F2C802C3F97778F2F72AD52264076F240EDCF78C62A0D4EBB32AD7A1834AC4EB378EED
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<!DOCTYPE HTML>.<html>.<head>. <meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>. <title>Payment request</title>. <script type="text/javascript" charset="utf-8" src="vendor/jquery-3.4.1.min.js"></script>. <script type="text/javascript" src="vendor/jquery-ui.min.js"></script>. <script type="text/javascript" src="vendor/qrcode.js"></script>. <link rel="stylesheet" type="text/css". href="vendor/jquery-ui-themes-1.12.1/themes/ui-lightness/jquery-ui.css">. <style type="text/css">.. body {.. font-family: Arial;. }.. .tab {.. overflow: hidden;.. border: 1px solid #ccc;.. background-color: #f1f1f1;. }. .tab button {.. background-color: inherit;.. float: left;.. border: none;.. outline: none;.. cursor: pointer;.. padding: 14px 16px;.. transition: 0.3s;. }. .tab button:hover {.. background-color: #ddd;. }. .tab button.active {.. background-color: #ccc;. }. .tabcontent {.. display

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-3.4.1.min.js

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (65451)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):88145
                                                                                                                                                                                                                      Entropy (8bit):5.291106244832159
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:yTExXUZinxD7oPEZxkMV4SYKFMbRHZ6H5HOHCWrcElzuu7BRCKKBEqBsojZlOPma:ygZm0H5HO5+gCKWZyPmHQ47GKe
                                                                                                                                                                                                                      MD5:220AFD743D9E9643852E31A135A9F3AE
                                                                                                                                                                                                                      SHA1:88523924351BAC0B5D560FE0C5781E2556E7693D
                                                                                                                                                                                                                      SHA-256:0925E8AD7BD971391A8B1E98BE8E87A6971919EB5B60C196485941C3C1DF089A
                                                                                                                                                                                                                      SHA-512:6E722FCE1E8553BE592B1A741972C7F5B7B0CDAFCE230E9D2D587D20283482881C96660682E4095A5F14DF45A96EC193A9B222030C53B1B7BBE8312B2EAE440D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery v3.4.1 | (c) JS Foundation and other contributors | jquery.org/license */.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],E=C.document,r=Object.getPrototypeOf,s=t.slice,g=t.concat,u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n||E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]||t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"object"==typeof e||"function"==typeof e?n[o.call(e)]||"object":typeof e}var

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\AUTHORS.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):12660
                                                                                                                                                                                                                      Entropy (8bit):5.007082424862998
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:CPi9lWCZ2RTCMfvMQAFYw7TFUAcj7uQNtpNA4tDTzrozIwm2vt31YmZ:VaZFkQSf7TFUAuA4c0wm213p
                                                                                                                                                                                                                      MD5:403511FC6C430EA6179EBCB4A9983EEC
                                                                                                                                                                                                                      SHA1:131842146D2B11D742A638F42739D7E0741DC026
                                                                                                                                                                                                                      SHA-256:5B62E1D666C6A373B0734A175FD535F9315549961A0BBD8ABD246BAD1A775082
                                                                                                                                                                                                                      SHA-512:97BADB94E8028918DB9EA30E3E038C4740941AA2C1BA284CCBC39A26157F771243CFC249F855228DE6DA3B7F7427B2ACD259318C6878F77529EB355762C15284
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:Authors ordered by first contribution.A list of current team members is available at http://jqueryui.com/about..Paul Bakaus <paul.bakaus@gmail.com>.Richard Worth <rdworth@gmail.com>.Yehuda Katz <wycats@gmail.com>.Sean Catchpole <sean@sunsean.com>.John Resig <jeresig@gmail.com>.Tane Piper <piper.tane@gmail.com>.Dmitri Gaskin <dmitrig01@gmail.com>.Klaus Hartl <klaus.hartl@gmail.com>.Stefan Petre <stefan.petre@gmail.com>.Gilles van den Hoven <gilles@webunity.nl>.Micheil Bryan Smith <micheil@brandedcode.com>.J.rn Zaefferer <joern.zaefferer@gmail.com>.Marc Grabanski <m@marcgrabanski.com>.Keith Wood <kbwood@iinet.com.au>.Brandon Aaron <brandon.aaron@gmail.com>.Scott Gonz.lez <scott.gonzalez@gmail.com>.Eduardo Lundgren <eduardolundgren@gmail.com>.Aaron Eisenberger <aaronchi@gmail.com>.Joan Piedra <theneojp@gmail.com>.Bruno Basto <b.basto@gmail.com>.Remy Sharp <remy@leftlogic.com>.Bohdan Ganicky <bohdan.ganicky@gmail.com>.David Bolter <david.bolter@gmail.com>.Chi Cheng <cloudream@gmail.com>.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\LICENSE.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1817
                                                                                                                                                                                                                      Entropy (8bit):5.104115525869163
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:UzHtub9kugsniJzfPvGt7ICQH+sfIte36AFdMhw+dEXt4V:uHtyyu2Put0CQHT6fhw+dEXeV
                                                                                                                                                                                                                      MD5:E0C0D3D883E83F19EFA64FEB54D5F63D
                                                                                                                                                                                                                      SHA1:15DF6665DFD90F5CD8FDFDE4C0C43051FBB76DAE
                                                                                                                                                                                                                      SHA-256:DE33FB695880D0B07615D4B86F78CD43796906959ADE5FDFEF70968827A0DB78
                                                                                                                                                                                                                      SHA-512:9D6477C8BC412206AE4258CB5D260AEDB593F5830F9B539F4A744BB6B9FEA35A1D36D3D82A5731EAE36FFBA1671705EE0CEA499320CC450D74B4F7A2898FA3AD
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:Copyright jQuery Foundation and other contributors, https://jquery.org/..This software consists of voluntary contributions made by many.individuals. For exact contribution history, see the revision history.available at https://github.com/jquery/jquery-ui..The following license applies to all parts of this software except as.documented below:..====..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INC

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\images\ui-icons_444444_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7090
                                                                                                                                                                                                                      Entropy (8bit):7.919659124224948
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:d0qa5wogj5iPmijz0onp6MYOF6zv/pw5a6a6kIBOI:za5U5yHp6XqCvB96aqOI
                                                                                                                                                                                                                      MD5:79B89CC07096D272B27EDEFCCE2DA120
                                                                                                                                                                                                                      SHA1:B19FF112C585040AEDEA7F24BD6A49D611564267
                                                                                                                                                                                                                      SHA-256:C1D0EE16F6D7056117904C782C1CB6294D1506604F34B77C8B4237672C676DC9
                                                                                                                                                                                                                      SHA-512:29F81723F15D7164537198C3E8F94366ECFF50D1987B3E5C17B058D82BAD6ABCFF35716C3529D53D0DA05DEAA95E1E55A4F684D4B5B4C482337798FEEFF01BB0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.D.<......tIME......6..F....IDATx..k.%Gu..m;....!.^.....l.0..[..HX..H...:w...8;.........g1s.....].&..<...............C.lfq..!,."....Wu...{.v.Gwn.>U.UuN=..S....d.5..x..^.../.2........,..+M..^....O..r..`.:..S.|.{.Y...`...`k?..a...6...1...@..5..S.#.Gd......).q.vX.u.B@.*.J@`H.N...A....1n.:.P..,D:A..q+.=...f.]S..q.!.....+Lm.>|...XhN.^.4.A...3C...J.....`Z.U.=.s.4.....)...-...`F8.i.RY..CP.....C.Z..:...{....p......@........px.h8..4.^...o...;..o2....Y..1m.=...v......E.GJH....i..U.g.>.k.6..R_.}.S..k..=..~5<.e..........n.oF......d{...U.^@...>]..L..-oz.....e..%PE.dR...=.I.l.O\r..6`.S..`...dxup....../........@........px.h8..t.....W.....9........... {...\..B0..]....(eQ........T..Q5.[.\B..{...V.......C...!4({\...h.w.g..{..Kh.....l.X..v.p-..Z.^IA.:......ur.&..%5.t.S...Ch...NKgn..\.Pv..:..[(......8.nb.K.Uk...]..A.^.50..\B.i......4l].[.mkA...L"....v...2=.[.Yo..8.2..c`.`

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\images\ui-icons_555555_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7074
                                                                                                                                                                                                                      Entropy (8bit):7.928012384219511
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:gMXxllGqNJYXQT1pTyOgoz8D1EYwRxOmTtWuXrevpJS/Rq3Kt3KlASyN6KaP:zXTvYXQzy51nfmcuXibSralG/aP
                                                                                                                                                                                                                      MD5:00DD0EC0A16A1085E714C7906FF8FB06
                                                                                                                                                                                                                      SHA1:244BD9B7C3B1C4F7EF72DE31F67804FAFF213715
                                                                                                                                                                                                                      SHA-256:5D04051DFD9D2D740355404F98A683D1EC0FEB2FCA7D76E533C1A6E5CE92DD2E
                                                                                                                                                                                                                      SHA-512:163AFECE9AE9693C41324FFD89191132A8D2E42D73F962ACE0B70B44A17D954C8F506CC25AF152397E2536DA6245E4336AE465708EDF6EDE955B4AD502AF7A71
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.U...I....tIME......6..F....IDATx..{.$G}.?m;....!.>...l.....G$,..&.%.|.........].]..=...?ptg..Y.G.. ...b...'....8$.f..;.#...A..G......3;...=..L..........W.^<................&.=.Ll&<.D.Y.V.D.^.`..O..r..`.:.$)...=.L.s....L.=?..a|..6...I#V+A...1.L).P.!......)$q..<....U`....r.2...t. )b....B.zDD....'O....{.5....[.Y.`..]az...GtwS..S..l.. 1.z..!(..h~.L.`V.U..{..g.ws...l.g......p.U.f.2..CP.....C...[.mVF.y...h8.J`....px.4.....'@....px.4... .w...d...p...)c.F{.....S.......>R$)g...3W....i...mk~[.+.O}.#c.P...._.OB..mz.-..=.)w.....i'.#...@.].S/..c.>]..L.[.......e.%PE.dR...=..\..').W..0..k.0..o2.:....A..'@....px.4.....'@....p.3........._+-..s.E.K%.2..5..UA...(.<..`......+H..=l...>0.b'G..n%p.U".YR.[..........R...q._`....H.5`...@.%6..b)....Z|.......t.Q.i.E.. Lc.J.xw.]..K... 7...........$0txzl.\.Y..wk..!uS...[..L..K..:(...f].K(......lN...u.'.vw.IdU.)n.K9(...u..f..c/.<....

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\images\ui-icons_777620_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.766413362618199
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:7sHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcH:oHm231Nvu+wIqltWOe3nIH
                                                                                                                                                                                                                      MD5:4E7E3E142F3939883CD0A7E00CABDAEF
                                                                                                                                                                                                                      SHA1:D20567FD436991539EAFD65C3BDE77D82A656012
                                                                                                                                                                                                                      SHA-256:9DBE4A0D03FEED6F65EB2560A0A8B4BA4264545EE8FD31C1763A3B219D0328D6
                                                                                                                                                                                                                      SHA-512:D145A64F637F34D9F9FEFAF7CEF14EA277D0933E16C625234A9C1E0A54A7F3D0D820AB49B4B68D5D3E9853399D74EFBA9FF7771BFD3481F8C1C70E6DC6F50275
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEwv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv .......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME......6..F....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\images\ui-icons_777777_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7111
                                                                                                                                                                                                                      Entropy (8bit):7.919098640897273
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:3ZL/Hq8z/FyEJ3kJpSiztKi4NkaerdCVHMh:x/HqpEJ3KpSiJKvNSrdCVHM
                                                                                                                                                                                                                      MD5:FEF4DC5A79A6117235D7ED374987A212
                                                                                                                                                                                                                      SHA1:690D30967A468B399320549E7D04F47E2E7F2E52
                                                                                                                                                                                                                      SHA-256:D5CBF092012C0710EA36A3A1C51072DABF7714AECE783A6D8B010396427E879C
                                                                                                                                                                                                                      SHA-512:07C5F904D0C2AEE27337753B4F038CCEFAEA5DED66D3C84B7352BEC6408D3D128A8BF1C5F0B3E9E72832CEFF5D5A395261F1E86C04160BAB99558E679E2D6972
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.wd......tIME......6..F....IDATx..{.eE}.?.H(cX.1..[R.`....J.H..E.$U....cE....Q.2;#...f.c.,Hj..cQ5...5P...qK.......$...1....%'..W.9.:..;..=...s.=..>...........h2..t.<../......mB...f....6+.J.D...0...&..s..N...._..B..s....&..>~.?...c{v..j%.....)...#D..E...F.I...G..........R.S.C...$EL..!..GD.NP)~..t.=;..w.me.B.z.s...S......M,4.R.m.. 1.z..!(..hnE.6.Uj.cO..6.y7..Y.~fK..1l..WM....*..+p.....G..Uz..F..Qb..^......px.h8..4.^.../........@.....q...MF.{.7...2.m..0?..:..vux.....r..n.0s....Os.....Wr...G...h..A....2...t[l.{.S..O..7#..N.G..=..Z.S/..co.......7...Vk.2O.....j.blc.l.`..[...<.%}a.......x...t.7.^..p......@........px.h8..4.^.....CF...W.....9........... {...\..B0..]....(eQ....G......jl....*..,)....C......r)BhP.../0...r.H(..0..,@.%6.....q.p-..Z.^IA.:......ur....%U|..)I...!4..ig.37.1...........E:..q7.......n..05A...uP..y..8.Pj....K.9.[...E.Z............L...u.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\images\ui-icons_cc0000_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.702209367432273
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:NsHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcH:6Hm231Nvu+wIqltWOe3nIH
                                                                                                                                                                                                                      MD5:2077B5EAB79CBBC34DC270E93BF36BBC
                                                                                                                                                                                                                      SHA1:296E7BC1A8528A7BFCEF17B4CD727D80285DEE50
                                                                                                                                                                                                                      SHA-256:B54DCE3082F3377765C041F959A72007702AB54457DA21A20DFB15BAF9740954
                                                                                                                                                                                                                      SHA-512:270AFFA25147BAE0713566E37D4B477C486DC77F4BFB8A239889BF3F31C073A402145345DDB8186D415838735852CC6F11567EA22F3497E496B1A903693F1774
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.............................................................................................................................................................................................................................................................................................................xS....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME......6..F....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\images\ui-icons_ffffff_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):6487
                                                                                                                                                                                                                      Entropy (8bit):7.9034761541412495
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:Sj0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxhi:SIgz9tEOJ4bKAPmZvqAbi
                                                                                                                                                                                                                      MD5:A90930462F29CF706358262D88F1B626
                                                                                                                                                                                                                      SHA1:C8B7178EB17C36A1DF4CA5BADF2A85834436FE9F
                                                                                                                                                                                                                      SHA-256:F93D2A7069B40745FD01E364ED57771BECFEBD8868BB9130220A47E0ABFF9C49
                                                                                                                                                                                                                      SHA-512:94775B3EC8843A93AB54E663E4E06728D6C2FD1E792802D8C5CCBDFFF96673F5B993039E1C65D178247CA2F21326F8D455B81425249663B54A1AAE59A423CA35
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME......6..F...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\jquery-ui.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2515)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):37326
                                                                                                                                                                                                                      Entropy (8bit):5.311560606113339
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:10OW0dCbMiEt7b6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHz:pCwiEt7b/+vaW1e07PPiF5fy/EzDS25A
                                                                                                                                                                                                                      MD5:6FD5A6E8197041971D02CF62D06F4B14
                                                                                                                                                                                                                      SHA1:9997BEC65F4FFFD3CA7178E14F67B8CD6AD1A9C7
                                                                                                                                                                                                                      SHA-256:A7AC54F58BA507B13621CEB6FCF5FE879F5AC9BDCF049D16153110C6AD048C7C
                                                                                                                                                                                                                      SHA-512:BABA481707CB23D6432FCD6CE9E26380117B2E91BE44E5E3A75A0DC138F8812942C34D0A895D6B581ADFB33577B9FE6BFAFEB6D5FB00C2ABF2D7044979E593FC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?bgShadowXPos=&bgOverlayXPos=&bgErrorXPos=&bgHighlightXPos=&bgContentXPos=&bgHeaderXPos=&bgActiveXPos=&bgHoverXPos=&bgDefaultXPos=&bgShadowYPos=&bgOverlayYPos=&bgErrorYPos=&bgHighlightYPos=&bgContentYPos=&bgHeaderYPos=&bgActiveYPos=&bgHoverYPos=&bgDefaultYPos=&bgShadowRepeat=&bgOverlayRepeat=&bgErrorRepeat=&bgHighlightRepeat=&bgContentRepeat=&bgHeaderRepeat=&bgActiveRepeat=&bgHoverRepeat=&bgDefaultRepeat=&iconsHover=url(%22images%2Fui-icons_555555_256x240.png%22)&iconsHighlight=url(%22images%2Fui-icons_777620_256x240.png%22)&iconsHeader=url(%22images%2Fui-icons_444444_25

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\jquery-ui.min.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (29137)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):32076
                                                                                                                                                                                                                      Entropy (8bit):5.255171404355352
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:pCwiEt7lcR8lOXHc11evBMzymUh+4C6G/zDcSc7nfZBhVi:slEtiXHcEBMznURC6G/zD8BhA
                                                                                                                                                                                                                      MD5:0B5729A931D113BE34B6FAC13BCF5B29
                                                                                                                                                                                                                      SHA1:88BA90D2D2944315AFD28A706EE5715ED980C634
                                                                                                                                                                                                                      SHA-256:AC1C8F94750B39B12327A5D0C56FDF946DABFB6D91E5D2A202879FF9A5D67E29
                                                                                                                                                                                                                      SHA-512:68E1B473A9CF3731A4FB9CE3C3225AA1152009D3AB7D20E198C203DAEE3E388B25AF41A3A4B2A8ED79B4028DF19A93384FC026228B9192AC23D67ADD56C2CA11
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?bgShadowXPos=&bgOverlayXPos=&bgErrorXPos=&bgHighlightXPos=&bgContentXPos=&bgHeaderXPos=&bgActiveXPos=&bgHoverXPos=&bgDefaultXPos=&bgShadowYPos=&bgOverlayYPos=&bgErrorYPos=&bgHighlightYPos=&bgContentYPos=&bgHeaderYPos=&bgActiveYPos=&bgHoverYPos=&bgDefaultYPos=&bgShadowRepeat=&bgOverlayRepeat=&bgErrorRepeat=&bgHighlightRepeat=&bgContentRepeat=&bgHeaderRepeat=&bgActiveRepeat=&bgHoverRepeat=&bgDefaultRepeat=&iconsHover=url(%22images%2Fui-icons_555555_256x240.png%22)&iconsHighlight=url(%22images%2Fui-icons_777620_256x240.png%22)&iconsHeader=url(%22images%2Fui-icons_444444_25

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\jquery-ui.structure.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2363)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):18705
                                                                                                                                                                                                                      Entropy (8bit):5.342686576013018
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:XW6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHL:XW/+vaW1e07D
                                                                                                                                                                                                                      MD5:B75D9919DED1B610C51A4727DD4B9720
                                                                                                                                                                                                                      SHA1:3C2C0061EEAFC1D3C0D8663481BEE315D38C5A5D
                                                                                                                                                                                                                      SHA-256:135BAA57E778D769DB488FA8A8330842C4D2B6D3FE152EC1C7073B99075060EA
                                                                                                                                                                                                                      SHA-512:72A4961E118A4D30F6BC7CB700520EEC3520C7BB680C9DE15CF9C9744E02ED81B34DE8E7B58F62675C5BEC6AB24F1CA1CC95AC10AF09A620335B6F4566AB04DD
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. */./* Layout helpers.----------------------------------*/..ui-helper-hidden {..display: none;.}..ui-helper-hidden-accessible {..border: 0;..clip: rect(0 0 0 0);..height: 1px;..margin: -1px;..overflow: hidden;..padding: 0;..position: absolute;..width: 1px;.}..ui-helper-reset {..margin: 0;..padding: 0;..border: 0;..outline: 0;..line-height: 1.3;..text-decoration: none;..font-size: 100%;..list-style: none;.}..ui-helper-clearfix:before,..ui-helper-clearfix:after {..content: "";..display: table;..border-collapse: collapse;.}..ui-helper-clearfix:after {..clear: both;.}..ui-helper-zfix {..width: 100%;..height: 100%;..top: 0;..left: 0;..position: absolute;..opacity: 0;..filter:Alpha(Opacity=0); /* support: IE8 */.}...ui-front {..z-index: 100;.}.../* Interaction Cues.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\jquery-ui.structure.min.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (15418)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):15548
                                                                                                                                                                                                                      Entropy (8bit):5.293143563287801
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:ti4ncR8lOG1bRCNPbtqxlhIuxrjv572hk/k52bZuQEjQDMsrsUR9P:tlcR8lOXHc11evs
                                                                                                                                                                                                                      MD5:5581D20AA5062ED5C0B6048F68E76055
                                                                                                                                                                                                                      SHA1:CF0560924A39F484D334498D5811836E4EC28E28
                                                                                                                                                                                                                      SHA-256:AF16A2B37EDA9CA527A4BE50CD262D7BE26722C9A41A62C6F9984A4A4664C153
                                                                                                                                                                                                                      SHA-512:A0CDB860EB208F5C820C7C16F3DE59B4AEF3A03420B1C9F09022D770F50DB13470A16D53D670C8BB0919ABF3BAA0B623A6ECF80DF103AF4D8F82EBBAF2BE3FDF
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Copyright jQuery Foundation and other contributors; Licensed MIT */...ui-helper-hidden{display:none}.ui-helper-hidden-accessible{border:0;clip:rect(0 0 0 0);height:1px;margin:-1px;overflow:hidden;padding:0;position:absolute;width:1px}.ui-helper-reset{margin:0;padding:0;border:0;outline:0;line-height:1.3;text-decoration:none;font-size:100%;list-style:none}.ui-helper-clearfix:before,.ui-helper-clearfix:after{content:"";display:table;border-collapse:collapse}.ui-helper-clearfix:after{clear:both}.ui-helper-zfix{width:100%;height:100%;top:0;left:0;position:absolute;opacity:0;filter:Alpha(Opacity=0)}.ui-front{z-index:100}.ui-state-disabled{cursor:default!important;pointer-events:none}.ui-icon{display:inline-block;vertical-align:middle;margin-top:-.25em;position:relative;text-indent:-99999px;overflow:hidden;background-repeat:no-repeat}.ui-widget-icon-block{left:50%;margin-left:-8px;display:block}.ui-widget-overlay{position:fixed;top

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\jquery-ui.theme.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2516)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):18671
                                                                                                                                                                                                                      Entropy (8bit):5.157579434617568
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:X3CbMiEtzlPiF5fy/Ec4dDAwQ2gmB0iBfT9RhS2wV53skuMaaSQhQz0iIhp:X3CwiEtpPiF5fy/EzDS25A
                                                                                                                                                                                                                      MD5:C4679DB4ADB3F9B8089213C6C396E2EE
                                                                                                                                                                                                                      SHA1:BD9C7C141312CE373116F98B120594408C1A6707
                                                                                                                                                                                                                      SHA-256:984303DF44D383EBC81065261C781C8123A09B41417CB8A9C90F7B26BD134C7F
                                                                                                                                                                                                                      SHA-512:29DC56431FBBABA567F72FEF2A525ADC6CACAC64DCB3C3B7480BD5546869536881FCBBE5AD959EFBA6E5F7E04CD1E109548FDD52572C90CE6361BCFB6F984630
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?bgShadowXPos=&bgOverlayXPos=&bgErrorXPos=&bgHighlightXPos=&bgContentXPos=&bgHeaderXPos=&bgActiveXPos=&bgHoverXPos=&bgDefaultXPos=&bgShadowYPos=&bgOverlayYPos=&bgErrorYPos=&bgHighlightYPos=&bgContentYPos=&bgHeaderYPos=&bgActiveYPos=&bgHoverYPos=&bgDefaultYPos=&bgShadowRepeat=&bgOverlayRepeat=&bgErrorRepeat=&bgHighlightRepeat=&bgContentRepeat=&bgHeaderRepeat=&bgActiveRepeat=&bgHoverRepeat=&bgDefaultRepeat=&iconsHover=url(%22images%2Fui-icons_555555_256x240.png%22)&iconsHighlight=url(%22images%2Fui-icons_777620_256x240.png%22)&iconsHeader=url(%22images%2Fui-icons_444444_256x240.png%22)&iconsError=url(%22images%2Fui-icons_cc0000_256x240.png%22)&iconsDefault=url(%22images%2Fui-icons_777777_

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\jquery-ui.theme.min.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (13719)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):13849
                                                                                                                                                                                                                      Entropy (8bit):4.869966761350074
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:tgGIzlzymUh+4pQz6G3PRBGWLiXxBm9v5B6xBpYPzFhCNBjVs5y6sybYw9QoFYx4:trMzymUh+4C6G/zDcSc7nfZBhVi
                                                                                                                                                                                                                      MD5:C12CAC44216CF877FD0C6903F3794407
                                                                                                                                                                                                                      SHA1:A3640158B618410B280A5F37E54661A8337D6BD0
                                                                                                                                                                                                                      SHA-256:023CA8C9A46D9C6553CB0287FC8B31C6EE4F5C8D2CE02704D01CCF017F373E97
                                                                                                                                                                                                                      SHA-512:F61ED746551E53070751FF5B3625924CEF68BCE58510BC5395588FF34D5EE416F0349E62AFDB9AE8BDB4B44AE8599766F8714101604BC76A87E25E101C7951CA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Copyright jQuery Foundation and other contributors; Licensed MIT */...ui-widget{font-family:Arial,Helvetica,sans-serif;font-size:1em}.ui-widget .ui-widget{font-size:1em}.ui-widget input,.ui-widget select,.ui-widget textarea,.ui-widget button{font-family:Arial,Helvetica,sans-serif;font-size:1em}.ui-widget.ui-widget-content{border:1px solid #c5c5c5}.ui-widget-content{border:1px solid #ddd;background:#fff;color:#333}.ui-widget-content a{color:#333}.ui-widget-header{border:1px solid #ddd;background:#e9e9e9;color:#333;font-weight:bold}.ui-widget-header a{color:#333}.ui-state-default,.ui-widget-content .ui-state-default,.ui-widget-header .ui-state-default,.ui-button,html .ui-button.ui-state-disabled:hover,html .ui-button.ui-state-disabled:active{border:1px solid #c5c5c5;background:#f6f6f6;font-weight:normal;color:#454545}.ui-state-default a,.ui-state-default a:link,.ui-state-default a:visited,a.ui-button,a:link.ui-button,a:visited.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\base\images\ui-icons_444444_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7090
                                                                                                                                                                                                                      Entropy (8bit):7.920105159011246
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:G0qa5wogj5iPmijz0onp6MYOF6zv/pw5a6a6kIBOo:ea5U5yHp6XqCvB96aqOo
                                                                                                                                                                                                                      MD5:23B19953D6FF01805EBAC2A86924837B
                                                                                                                                                                                                                      SHA1:CE3119A5D6AF1B50FF8D750DB706B6A3D5628796
                                                                                                                                                                                                                      SHA-256:EB8DFEB98C17CA86564BC8B629D33DB66BFCB9D70B92E0718BEBFA9341E75607
                                                                                                                                                                                                                      SHA-512:FD8772D61727CF266E18457F3C70499834EF9B0FB6C68A53762593827D72CAFD9D208741B6BF5C2CB9F8F6E97083B85BF9F81B339B8CBCA8BC251CE3DC335F69
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.D.<......tIME.....%...'E....IDATx..k.%Gu..m;....!.^.....l.0..[..HX..H...:w...8;.........g1s.....].&..<...............C.lfq..!,."....Wu...{.v.Gwn.>U.UuN=..S....d.5..x..^.../.2........,..+M..^....O..r..`.:..S.|.{.Y...`...`k?..a...6...1...@..5..S.#.Gd......).q.vX.u.B@.*.J@`H.N...A....1n.:.P..,D:A..q+.=...f.]S..q.!.....+Lm.>|...XhN.^.4.A...3C...J.....`Z.U.=.s.4.....)...-...`F8.i.RY..CP.....C.Z..:...{....p......@........px.h8..4.^...o...;..o2....Y..1m.=...v......E.GJH....i..U.g.>.k.6..R_.}.S..k..=..~5<.e..........n.oF......d{...U.^@...>]..L..-oz.....e..%PE.dR...=.I.l.O\r..6`.S..`...dxup....../........@........px.h8..t.....W.....9........... {...\..B0..]....(eQ........T..Q5.[.\B..{...V.......C...!4({\...h.w.g..{..Kh.....l.X..v.p-..Z.^IA.:......ur.&..%5.t.S...Ch...NKgn..\.Pv..:..[(......8.nb.K.Uk...]..A.^.50..\B.i......4l].[.mkA...L"....v...2=.[.Yo..8.2..c`.`

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\base\images\ui-icons_555555_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7074
                                                                                                                                                                                                                      Entropy (8bit):7.928410973506381
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:HbTMXxllGqNJYXQT1pTyOgoz8D1EYwRxOmTtWuXrevpJS/Rq3Kt3KlASyN6Ka3:8XTvYXQzy51nfmcuXibSralG/a3
                                                                                                                                                                                                                      MD5:EEBB826ECD3EBE8C61B5EE9645879A2B
                                                                                                                                                                                                                      SHA1:78B80151260D9A2722BE8D5C17AEB27EFF194C58
                                                                                                                                                                                                                      SHA-256:A19D489F7769610F4AE20BBA35E81041BADADB8BC443D256D33EACECE74E909A
                                                                                                                                                                                                                      SHA-512:DA08F4C488ED432661493233D3CA07E015EE39566CFE80360CC94B5EFCF1F28559BC2CB622466948DEC6E6A22ABBBE67EDEC7450FC24AC311CD19003675F44E1
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.U...I....tIME.....%...'E....IDATx..{.$G}.?m;....!.>...l.....G$,..&.%.|.........].]..=...?ptg..Y.G.. ...b...'....8$.f..;.#...A..G......3;...=..L..........W.^<................&.=.Ll&<.D.Y.V.D.^.`..O..r..`.:.$)...=.L.s....L.=?..a|..6...I#V+A...1.L).P.!......)$q..<....U`....r.2...t. )b....B.zDD....'O....{.5....[.Y.`..]az...GtwS..S..l.. 1.z..!(..h~.L.`V.U..{..g.ws...l.g......p.U.f.2..CP.....C...[.mVF.y...h8.J`....px.4.....'@....px.4... .w...d...p...)c.F{.....S.......>R$)g...3W....i...mk~[.+.O}.#c.P...._.OB..mz.-..=.)w.....i'.#...@.].S/..c.>]..L.[.......e.%PE.dR...=..\..').W..0..k.0..o2.:....A..'@....px.4.....'@....p.3........._+-..s.E.K%.2..5..UA...(.<..`......+H..=l...>0.b'G..n%p.U".YR.[..........R...q._`....H.5`...@.%6..b)....Z|.......t.Q.i.E.. Lc.J.xw.]..K... 7...........$0txzl.\.Y..wk..!uS...[..L..K..:(...f].K(......lN...u.'.vw.IdU.)n.K9(...u..f..c/.<....

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\base\images\ui-icons_777620_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.766757991708586
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:7NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:rHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:0F7BB232F0077013CFE3231B6D56F201
                                                                                                                                                                                                                      SHA1:07183152ECF40C6F277B3DDD3A841C4F9F046611
                                                                                                                                                                                                                      SHA-256:FE1AF6959B854C63CF101E6F51B8F15296A66A287FDF4B1283A3AF199D2294F7
                                                                                                                                                                                                                      SHA-512:B29F864170DB2C7B21E2530D16C76757045A91173CFB8F1A99CCD214D2625F74C986D10A98A339B8E81D65757362876A9060EE9D3C2FAD994B8F61783866A615
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEwv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv wv .......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\base\images\ui-icons_777777_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7111
                                                                                                                                                                                                                      Entropy (8bit):7.919277243804909
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:+ZL/Hq8z/FyEJ3kJpSiztKi4NkaerdCVHMl:y/HqpEJ3KpSiJKvNSrdCVHM
                                                                                                                                                                                                                      MD5:EE545339F50EAF87C6AC783B2C8D17E8
                                                                                                                                                                                                                      SHA1:FD1AEC501E23B0A7A022DE638234C15316AA7D70
                                                                                                                                                                                                                      SHA-256:04E0C4263C2829DC10E9E1E39E9D186F60775B7BBE5B15BCC0B33BE5B0E575EA
                                                                                                                                                                                                                      SHA-512:BD889EA0D6EABB217C019D78A362B29D2575BFDDE5C4A403182052B9E198F59AA36091BD8267A474864717C01D0203225C6D29C1AB3CF086A87B93E40128A3EB
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.wd......tIME.....%...'E....IDATx..{.eE}.?.H(cX.1..[R.`....J.H..E.$U....cE....Q.2;#...f.c.,Hj..cQ5...5P...qK.......$...1....%'..W.9.:..;..=...s.=..>...........h2..t.<../......mB...f....6+.J.D...0...&..s..N...._..B..s....&..>~.?...c{v..j%.....)...#D..E...F.I...G..........R.S.C...$EL..!..GD.NP)~..t.=;..w.me.B.z.s...S......M,4.R.m.. 1.z..!(..hnE.6.Uj.cO..6.y7..Y.~fK..1l..WM....*..+p.....G..Uz..F..Qb..^......px.h8..4.^.../........@.....q...MF.{.7...2.m..0?..:..vux.....r..n.0s....Os.....Wr...G...h..A....2...t[l.{.S..O..7#..N.G..=..Z.S/..co.......7...Vk.2O.....j.blc.l.`..[...<.%}a.......x...t.7.^..p......@........px.h8..4.^.....CF...W.....9........... {...\..B0..]....(eQ....G......jl....*..,)....C......r)BhP.../0...r.H(..0..,@.%6.....q.p-..Z.^IA.:......ur....%U|..)I...!4..ig.37.1...........E:..q7.......n..05A...uP..y..8.Pj....K.9.[...E.Z............L...u.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\base\images\ui-icons_cc0000_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.702553996522658
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:NNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:dHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:43C9C3B95C08C992741D28AF12E36597
                                                                                                                                                                                                                      SHA1:0F8640441757AC39626E42E6072B5E054F3523D9
                                                                                                                                                                                                                      SHA-256:679FD5C7A9307B11B44F72140129D489B2CDA77C9001CCAE7FE7C564534FBA5B
                                                                                                                                                                                                                      SHA-512:2D0BA16FAF9239D809E3C05C5561CA7F838CC013FB71357D83A1BC321B97D8DFF4F7F722E051767DD8336ABDE86DEF3BF569FE69FF485EDC959104F8F69080DC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.............................................................................................................................................................................................................................................................................................................xS....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\base\images\ui-icons_ffffff_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):6487
                                                                                                                                                                                                                      Entropy (8bit):7.90376532755891
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                                                                                                                                                                                                      MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                                                                                                                                                                                                      SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                                                                                                                                                                                                      SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                                                                                                                                                                                                      SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\base\jquery-ui.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2363)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):35973
                                                                                                                                                                                                                      Entropy (8bit):5.266740217260602
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:10OW02ANbMb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHllPb:xMb/+vaW1e07/PiF5fy/EzDS25qb
                                                                                                                                                                                                                      MD5:C4A88EC0CB998929A670C0C58D7DC526
                                                                                                                                                                                                                      SHA1:03135A88E8DBC36020DD453D1E7407CE9A3A2CC2
                                                                                                                                                                                                                      SHA-256:44F8A56D427917B5FA0DD7933BA545679BE5E6B3B93099E64A4E29C2159F57C0
                                                                                                                                                                                                                      SHA-512:FD0D6C06ABCD661796DB2BC071C2A2BBFC5CFE8D80B434B68CD068CC312A03FF0C93F21C1FCE77C2BC03486A80765EE317239639C79F2EDC03777918A36EFA1F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Arial%2CHelvetica%2Csans-serif&fsDefault=1em&fwDefault=normal&cornerRadius=3px&bgColorHeader=e9e9e9&bgTextureHeader=flat&borderColorHeader=dddddd&fcHeader=333333&iconColorHeader=444444&bgColorContent=ffffff&bgTextureContent=flat&borderColorContent=dddddd&fcContent=333333&iconColorContent=444444&bgColorDefault=f6f6f6&bgTextureDefault=flat&borderColorDefault=c5c5c5&fcDefault=454545&iconColorDefault=777777&bgColorHover=ededed&bgTextureHover=flat&borderColorHover=cccccc&fcHover=2b2b2b&iconColorHover=555555&bgColorActive=007fff&bgTextureActive=flat&borderColorActiv

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\base\jquery-ui.min.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (29135)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):30724
                                                                                                                                                                                                                      Entropy (8bit):5.207927153668432
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:xMlcR8lOXHc11evBMzymUh+4C6G/zDcSc7nfZBhVtQ:xHXHcEBMznURC6G/zD8BhY
                                                                                                                                                                                                                      MD5:8DCEBF12FBABEA677390CFA6D9AD09FB
                                                                                                                                                                                                                      SHA1:3765BA197944D25B3AEFE663300F0C74A6EEE792
                                                                                                                                                                                                                      SHA-256:B0419FAF03242236E04C1C062D52B7F011BF5F0222342FC4006F51CEC7DD6BA0
                                                                                                                                                                                                                      SHA-512:A24138A305C3D247D7CE05570730832224929695E7DED25B36876782C4E72183C95A3B9886D27EA8CA1CD3E594C0B1DE3B09ECD309B9ECA6BDD3716A40A335B0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Arial%2CHelvetica%2Csans-serif&fsDefault=1em&fwDefault=normal&cornerRadius=3px&bgColorHeader=e9e9e9&bgTextureHeader=flat&borderColorHeader=dddddd&fcHeader=333333&iconColorHeader=444444&bgColorContent=ffffff&bgTextureContent=flat&borderColorContent=dddddd&fcContent=333333&iconColorContent=444444&bgColorDefault=f6f6f6&bgTextureDefault=flat&borderColorDefault=c5c5c5&fcDefault=454545&iconColorDefault=777777&bgColorHover=ededed&bgTextureHover=flat&borderColorHover=cccccc&fcHover=2b2b2b&iconColorHover=555555&bgColorActive=007fff&bgTextureActive=flat&borderColorActiv

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\base\theme.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (1166)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):17319
                                                                                                                                                                                                                      Entropy (8bit):5.050806478020723
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:XcANb8lPiF5fy/Ec4dDAwQ2gmB0iBfT9RhS2wV53skuMaaSQhQz0iIhBb:XLCPiF5fy/EzDS25qb
                                                                                                                                                                                                                      MD5:829DF24BE21885E09FA3E76156B47087
                                                                                                                                                                                                                      SHA1:285600EDCD4B0CAFA3C82FC9C9A32310B7483B91
                                                                                                                                                                                                                      SHA-256:6DE4F2D1B262787509F1D31EC58C9DE526A12833E0D10B6C2DD085F69AAFEC72
                                                                                                                                                                                                                      SHA-512:0F3999088E42FB1F83F1AE4C037B25EF407A6FC078DFAC71C0B5F0B0A2CDF2BA97C6C0C3ABE92D73B3D26AFDC4A5AD95979A0E06E92C093CF1E8967685D7EDD2
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Arial%2CHelvetica%2Csans-serif&fsDefault=1em&fwDefault=normal&cornerRadius=3px&bgColorHeader=e9e9e9&bgTextureHeader=flat&borderColorHeader=dddddd&fcHeader=333333&iconColorHeader=444444&bgColorContent=ffffff&bgTextureContent=flat&borderColorContent=dddddd&fcContent=333333&iconColorContent=444444&bgColorDefault=f6f6f6&bgTextureDefault=flat&borderColorDefault=c5c5c5&fcDefault=454545&iconColorDefault=777777&bgColorHover=ededed&bgTextureHover=flat&borderColorHover=cccccc&fcHover=2b2b2b&iconColorHover=555555&bgColorActive=007fff&bgTextureActive=flat&borderColorActive=003eff&fcActive=ffffff&iconColorActive=ffffff&bgColorHighlight=fffa90&bgTextureHighlight=flat&borderColorHighlight=d

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-bg_diagonals-thick_8_333333_40x40.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 40 x 40, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):383
                                                                                                                                                                                                                      Entropy (8bit):6.418386094265965
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhP0CUyKOkp4/ZGwZaar2s3pMcXRs0w8UvFkfxxzgN+E8VLEMlVbEbp:6v/7MCUUGhLSJQIZxzS+EELEMPS
                                                                                                                                                                                                                      MD5:F9116832CBDC3F3EEE2DF7EB0F6A53B2
                                                                                                                                                                                                                      SHA1:BDD7D30174D4AD3A2C2DE75293514C5B799AE7F8
                                                                                                                                                                                                                      SHA-256:E118AF3DA06F5EF3A6AF384E50F1A84C63C7B4F4186E5F81D939DA5792FCF19F
                                                                                                                                                                                                                      SHA-512:45C8553BD148FF24CBD55AAECD4D053D73B334AFC58EF3E7FAEA54B00095352E3DAA23ADFED7CA68D4465159CF2D9F676E361AAAD958E974587F12B61EB68A51
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...(...(.......;.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x.......IDATH...1..0...g\z.."^.{.J]..Rj)".......h.[.S5%kH.5....\.)...'..I.v.\.(.W.....{.....@.. .I.r....c.....M6...c..$...\t...N.N.N.6....N..r_...5.j...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-bg_glass_40_111111_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):323
                                                                                                                                                                                                                      Entropy (8bit):5.943230772078117
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPh8TUyKOkp4/dM5auUVA6qhElyrn9e0xzgN+E8VLEMlVbEbp:6v/7JSU4M5DUQMyrn9XzS+EELEMPS
                                                                                                                                                                                                                      MD5:D13BE7DB4996BEE314A57491201C8B58
                                                                                                                                                                                                                      SHA1:4AFC6DE24265229B1CFA27C0DD3984C53F51C69C
                                                                                                                                                                                                                      SHA-256:BAF8E63100F2F3FD4943853828A6E7D63516FFEDF475F91C6DE10FBF59306D7F
                                                                                                                                                                                                                      SHA-512:D359FE3EB8DAF1E2F03E81355FA812C945512D0D681A49CF92990928F36756FBEED324C1D6BE1AFE5E841778D0C467E88A1957F4B074AF61643B185465E97189
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR................D....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......KIDAT8.c0.ab`.E....AP.Ah"...&..L,.L...X.0..3..0.<`b...Z..........0...EC.......ko,R...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-bg_glass_55_1c1c1c_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):323
                                                                                                                                                                                                                      Entropy (8bit):5.998240864963048
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPh8TUyKOkp4/dknvmNpO+i5sjLuQzgN+E8VLEMlVbEbp:6v/7JSU4kvmNU1GpzS+EELEMPS
                                                                                                                                                                                                                      MD5:F7F7F2042EC068FB769B614ABC136089
                                                                                                                                                                                                                      SHA1:8AD56700FB8DC32FCABD4604128C9C29814CA17B
                                                                                                                                                                                                                      SHA-256:EA8CAA1338B99BBA1AD99BAF12910FC9659CE3CD717BB7A756F395F8CE1186AF
                                                                                                                                                                                                                      SHA-512:145D31F2CEF8B1A9051A7B19E5666D83148866068AF6EB6268F7F1C9CE81F8EB741B719FB39B344FD17C5CD8C3129664925AE85D94A309512B71400D8D755C1F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR................D....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......KIDAT8.c.gb`.E....AF...;.K...+..K..fLl)L.....1..0..0.=eb.db.ab...X7...EC........X....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-bg_highlight-hard_100_f9f9f9_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):315
                                                                                                                                                                                                                      Entropy (8bit):6.069460361707883
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPedUyKOkp4/+rMiManu6qbNb1Z5/0xzgN+E8VLEMlVbEbp:6v/7WdULx/u6qBRHgzS+EELEMPS
                                                                                                                                                                                                                      MD5:DD8011FFC4BE430E76DDA8C3DF420FA7
                                                                                                                                                                                                                      SHA1:2635A9A6806D0CE478500624EAEAC4A0CB3638CD
                                                                                                                                                                                                                      SHA-256:7275896D796C6A96FC4CFB741BAAAB19A2A9062923879CE19BA13A85D07575B2
                                                                                                                                                                                                                      SHA-512:964C87BECB4621A647DA780A4EAD464D94E61DA9451C9F4DF755C04A17EA9D9265D3BD090F0ECA8AA3DE5662707FDF236E7F990275D9D4174BBA1A688891DA83
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......CIDAT......0.@.....].)P.b.H.;....%a.&7...<!..W..~.F..%UN"...'........|....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-bg_highlight-hard_40_aaaaaa_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):316
                                                                                                                                                                                                                      Entropy (8bit):5.953737371641402
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPedUyKOkp4/KjtXL85/j6czgN+E8VLEMlVbEbp:6v/7WdU185/5zS+EELEMPS
                                                                                                                                                                                                                      MD5:3B10BAFB1BFEBC8958BFAF5AA18372D7
                                                                                                                                                                                                                      SHA1:D77817917C1C2F2002AB60481B07CD3A004B19BE
                                                                                                                                                                                                                      SHA-256:E3E1813A7CF5A6DE95E8E11FFB960C7EDEFD7FAAD9231C82B614A33A4C7E843F
                                                                                                                                                                                                                      SHA-512:24BFB8E3E0AB53A31F05B54C8A7FB37F814D944C3AE234BC02A252CC152ACBE529336FCA138D3755F0B57EB7F11A6C0190B61C4F98CB2480619FB69645300375
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......DIDAT..c....0p....#..g...3.|......?E...L....;1.kg...........N.&......\N.....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-bg_highlight-soft_50_aaaaaa_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):327
                                                                                                                                                                                                                      Entropy (8bit):6.091868777218178
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPedUyKOkp4/Kd+/G6VUUPTSW0xzgN+E8VLEMlVbEbp:6v/7WdUjd++QPTvIzS+EELEMPS
                                                                                                                                                                                                                      MD5:A7C11E299800DCDB2F55A13F45B918F7
                                                                                                                                                                                                                      SHA1:37A870A99EDDCBDF6AFDA87CAD35FF859DA5ACE3
                                                                                                                                                                                                                      SHA-256:504BBD359106983B5F2308454EFF131488AA8D7045024404D38B5B33DF35731A
                                                                                                                                                                                                                      SHA-512:9086DE10BC06FBB4B39005A4701A344BFAB32868CAFD5595AE96DC5C79F3F4C79369DA91D12CEB44BFC0D5C9113491F0163176A22967BEB4C1259112A01EF2D7
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......OIDAT......@..v".......z^".xJ.o.....3.... u..g\.q......^9Gr.c .+.6Z........$Wq......%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-bg_inset-hard_45_cd0a0a_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):382
                                                                                                                                                                                                                      Entropy (8bit):6.324898529211006
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPeogUyKfp5EJ4/YWBCKcBEtB4TxlkYyoLmV0mpmI2zgN+E8VLEMlVbEbp:6v/7WogU9+zW0KrmxlC09xJzS+EELEM6
                                                                                                                                                                                                                      MD5:0C015DD5EA07876869017B31E20A21CA
                                                                                                                                                                                                                      SHA1:E7AD3FD785801B29871B26B93C815B0823A21217
                                                                                                                                                                                                                      SHA-256:6BF056456FF1EC2AAA9E7EC59C12EE6C27BBFC1815040AFBB71F676510EB9EFC
                                                                                                                                                                                                                      SHA-512:9E538918F1B270233B0FCA3237202FED8DBC057007F8DE14494D531D36EDE0E992F79C17623DF172057441671AB9F8E4BF2DBC839115FA9D8E0BF29F12082F70
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDAT(.c8{...........a.".b8..}........,/.._.a.acb..r.....:...%...TDUD..m......D.D...X....*ab.`5e5eb..z..8.#...>.>.L...............O...I...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-bg_inset-hard_55_ffeb80_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):367
                                                                                                                                                                                                                      Entropy (8bit):6.3091011246601845
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPeogUyKfp5EJ4/mi30kxY5/Us8hspVXE7zMr2zgN+E8VLEMlVbEbp:6v/7WogU9+OS5csQsYgKzS+EELEMPS
                                                                                                                                                                                                                      MD5:CA9994B73AE1D814651B5C432454C125
                                                                                                                                                                                                                      SHA1:960844631D6DD1945B037F7A1C34BA4BF4FC069F
                                                                                                                                                                                                                      SHA-256:7EFE027B1718E3D144748C0536C3F2F51EFBDCE091947D3130B1E1D758D79945
                                                                                                                                                                                                                      SHA-512:599891DA64A297AB12F061E30FCBAD13BE729C7647A58AE6850CCD4050169ADE5DE1F964A79F97209BDF41C5E0C5E1A36A409166716430FAA27752E78D0F683C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x......sIDAT(.....0.D...-Q.Af`..T..=....D...sd.....S...B..t.Qk))..v~.N......h.....L.&...e...n.Z?.3.l......^......oV.....i/....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-icons_222222_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7025
                                                                                                                                                                                                                      Entropy (8bit):7.929805003010536
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:IcH5ZfLGSAsNh7vB1PP0M6hPmBmc8aWkRwP4:xHjLV9b7vbaxNcbdKg
                                                                                                                                                                                                                      MD5:23ACA9C182696DB96FF9EE5BF9601461
                                                                                                                                                                                                                      SHA1:F2FB72129DB2BA61E5E9E572B24D82FB93ACC3F4
                                                                                                                                                                                                                      SHA-256:28D8B65FD4815EBFFB752BEB60B976D22E8BD4004194B8CFDD0E9A14E39814BD
                                                                                                                                                                                                                      SHA-512:F36FE89779D9EEDD2456826125166428824ABD33C999B187F69F976F51A5FAE7A2B286B44C4312B7B920BDBE0F043EBB652723962267489EB0B575EB5179FEC0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD."..b.....tIME.....%...'E...TIDATx..m.%Uy...$.!,h. ,.%..&...@.|I..E.M.r...D.....2;.f.....A^$5...j^.K.@U.....-.wW...D`..|.q..".t>........3}.S...~.9}.<.>..<.yNp..M.)....`...px..h...t%....y.Y...D.^.`..O..r.%`.:.$%...{.....0L.L..?..a|..6.....]A......7P..'@/:.]5JH.&.ay.......2....:.8t..y.....@.....#*'..?..t.;.Yw.m..........{.>|Dg7..\J.{.4..K.......3...t.f.Z...`.7.u7..Y.~f].<.....4m.*..<.%%...{.^.`....FR........l8<...O........h8<...O..........k.2..n..6cL...`>.]=u........$....,`.&.+h..k.6..J_*|.K.0...?@..lx..do..m.]..L.3...0.;......T.E,;...4......t...MO...mP.L..U.A&......e...+..`...8u...].5.7.7.~"....h8<...O........h8<.....]..C8.Y..s....Z..}i.A. ...).s.W...!.m.........z.[.#...R.....\R..{...v..........r.....R.. .?.#..[.|.f....`.........y...).A...-..Q.N..4w....:Kr{.......3...Z.P.!0t.{l.\.Y..wSn.P.IA..Vm..-.R...$y.....sI....@;..e.X...v......Y.v...B....n]g.......W..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-icons_4ca300_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.750560950350824
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:UNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:+Hm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:9D55E0E837EE95E3E837DC2E0DE0F7C8
                                                                                                                                                                                                                      SHA1:95EA22082368AA0BBEEE4597E7FCBEC6C4CC881F
                                                                                                                                                                                                                      SHA-256:457C38A99605DAF10195C3A8C87C06318FA0FF040B75A600A8D54604490BA97A
                                                                                                                                                                                                                      SHA-512:F903837E8FCAD110872114B9E3C1C16C6FABAB31CFAFD1C602FC2B0CF8CADCC99AC2DD9C7AD25D18153D391632CAE8BC508901FA2E510A85D8C250A796F27852
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEL..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L..L...<.k...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-icons_bbbbbb_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7092
                                                                                                                                                                                                                      Entropy (8bit):7.923076697213992
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:+bdL0XdnQW8FLZ3Iz6QlfUGxGO7TjLZxkSR5jsUeuOkjFWr4n2Otk54c+tEBNrDb:ykSFt+7/xpT3Zua5gewr4smcZrDaIx
                                                                                                                                                                                                                      MD5:947F1A81E0EEECAD8A78B92B269E3C2F
                                                                                                                                                                                                                      SHA1:4ADACD01B707EAF141426B565937D0651EE0F808
                                                                                                                                                                                                                      SHA-256:748E923944BED881A8384BD8F6A90D83BA56C30B3FDA34E77A3A2EB3381518F1
                                                                                                                                                                                                                      SHA-512:41C5907FA5532A13490E462CB9D5218FF06CC8B0C40DD29FCFD4BA55FAC3225D0B13A55900A3CD77B6ED36996A003D52C63A90622AEF6DB6353009892A6BE1B2
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD...>I6....tIME.....%...'E....IDATx..{.eE}.?.H(bX.1..[P.`....J.H..Ef..M.b...F....,.3...`V.;..!.]..E.<.K.@U.#"..-.gWEBL"8+qW..q.#E,9......9..w....{..u.........u.(.M.i..G....... .EH...Hx...2..$........+.\.....8..................FOoi...3.Z...W".0.<D}DV.....B.7n..Q'.....+.....q..$..q..v.C....B..T...2..m..k..5e[.7............x....T.M...M.^?3`.J...[.....Z...S0.Ms..}`.....T(/.f.}......<..)...]D..`....0.../..._.l8..4.^.../........@................=..E.M..2....`gO.{..:\.}....=....\.z...\..mc.-...>....(....W..P&}..n..b.`.....f.Q...P@..P].Xq...a.............jmP.I..U.A&..........%..`.._9u.......W.7.~!.....px.h8..4.^.../.......~g`...q...Zi...Q/zO*..9..9......C..! .....?@X.R.U.a.`}`L...Uc...%T...I.l.......8T.K.B...%...&..{FL....f..-.....g.....u..t.....H.(Z'.a.;PR.OW=%n^.<...9.t.f..e.e'..C.r..jm...C.&...[..LM.%m{...e^....%..f....lN...u..d{..$.*."n.K9(...u..f..c/.<...

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-icons_ededed_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7011
                                                                                                                                                                                                                      Entropy (8bit):7.932572114070276
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:1bBnMc0k8bUamXEHXe/FOIg7O/8zKLnH+48ZJsihJm14JQZOZ0l0z3QODetQ3KxF:4dnmU3QOIuEH8s4JmYQZVCNStQ3KZZ
                                                                                                                                                                                                                      MD5:65A3748BAB77F6483133EC328B188064
                                                                                                                                                                                                                      SHA1:F57C6E88D41BD50674D2D017EF9AF010046A9F07
                                                                                                                                                                                                                      SHA-256:86069EA4DC6EC1F1E7BEB42F4D2FB463FCE56BB5EBB0E9EB35AF805CA437A995
                                                                                                                                                                                                                      SHA-512:64CB897C58F276E07F5F10FF399F48B720C8AFB5202C823DD64180B1BEE7D6460B6D32826D3315457A38085DB656C077648EB81432F3B9D3E2E7C0D7A26745D6
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..t6......tIME.....%...'E...FIDATx..m...y..c.Z.....c.......BR)....6.bz.H...I.i.z.w.......P.-...z.6MR,...U.X.b;).n..XCc..8.*.......63..{..W..w.s.9...9.s...7.u.^W...p..9..D4.i...K.G.4...su.@......._:........{....H.}....:...u~?<{S..t.H.. P.|H.]...G....p[.....}X.U..<0...)..5...x. ...>P..\.......e....W..m.k\FHz.}.h..=h.>...T./......%W.g..^.@.]....F-{.K........dS?..P..z.=o.&s.......{...D.....dn..k.#@..f.k.G......p..9..j.G......p.........?..G.........`VO....9<..@...?...L.j.mS|.-.~S.s.Ou............R..mj.)..?..v......eG.....@.].U/ Oc.?m..t..]......E.,P...3...?..\..'.rg....S....._b8sp..&.j.G......p..9..j.G......8....;.=..>WZ...U..F.e.|c....9{p.......o.../!)...0.?P..-.L.....&U..+.....,.@..h .K.5....y...Y.......+...7...M,.?=..^..[..H^.:x_k.4..Uj..=.4}v.Y..K]._#..\..6H........cJe..r...r=..u..).l..nA...m...y.L.8.Tr...43X_.....Mw...6..ea..Y..H.`.uV{..,{.n...

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-icons_ffcf29_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.767851566820116
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:WNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:oHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:E03E6956FA5640722F7BFBF9F22760E5
                                                                                                                                                                                                                      SHA1:E18833F077DE41C9A359BFDB7E7DF79131DBA564
                                                                                                                                                                                                                      SHA-256:1A5FE2498D6C5FBB906E0A68C0A48BF08DC144A7CDEBB983B6F17CB35198B9BF
                                                                                                                                                                                                                      SHA-512:F258995BB5DB6C920819093DE011B79201B6AEE90B57E20E1F781393E0FD4B5A1F26CFC6BB623F070B524E1C384A56CCAE932A984F650E07A66F8CCE62252771
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)A......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\images\ui-icons_ffffff_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):6487
                                                                                                                                                                                                                      Entropy (8bit):7.90376532755891
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                                                                                                                                                                                                      MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                                                                                                                                                                                                      SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                                                                                                                                                                                                      SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                                                                                                                                                                                                      SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\jquery-ui.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2363)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):36674
                                                                                                                                                                                                                      Entropy (8bit):5.276783694401348
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:10OW0SvuQb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHVVoEa:evuQb/+vaW1e07asF5fyzE+DS25Plak
                                                                                                                                                                                                                      MD5:BEED825A76BBA558B11EE1D2683BE1F9
                                                                                                                                                                                                                      SHA1:5B3865CC0ADBB0CF8E54AD63687BB5B8D84878E6
                                                                                                                                                                                                                      SHA-256:1A81C06B3EAB67DBD6225F0DA9C691D52C3E9212A4D56CC078C75E816DF65160
                                                                                                                                                                                                                      SHA-512:9AA268EC3CC7C85007B45A26700BD0DF0B84800843DFB8A5BD752500932D407EEBD4EBFCAFB6BBDB4C24E438A2FAC0CA045D75DFD455DC1A8AA1B757C67747A4
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=333333&bgTextureHeader=diagonals_thick&bgImgOpacityHeader=8&borderColorHeader=a3a3a3&fcHeader=eeeeee&iconColorHeader=bbbbbb&bgColorContent=f9f9f9&bgTextureContent=highlight_hard&bgImgOpacityContent=100&borderColorContent=cccccc&fcContent=222222&iconColorContent=222222&bgColorDefault=111111&bgTextureDefault=glass&bgImgOpacityDefault=40&borderColorDefault=777777&fcDefault=e3e3e3&iconColorDefault=ededed&bgColorHover=1c1c1c&bgTextureHover=glass&bgImgOpacityHover=55&borderC

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\jquery-ui.min.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (29598)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):31403
                                                                                                                                                                                                                      Entropy (8bit):5.218906180606099
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:evuQlcR8lOXHc11evhdaizkmm+4e6GpbPJSc7nfZBhVwWGc:e2LXHcEhEiz1+e6GpbP3Bh3
                                                                                                                                                                                                                      MD5:1A7F4CBB81865BDE3C2688094010597D
                                                                                                                                                                                                                      SHA1:FAD0EA59849100A277AB699429B6ED863C50DC01
                                                                                                                                                                                                                      SHA-256:332BB17ECBC7843D708B19820FE827737CDF11059F28413111B86004382C69B3
                                                                                                                                                                                                                      SHA-512:D38AFB63C3784E1ED527EA86FB868154857C01090FECC262E792032387464D8D343E3BF03B811AEE0CFE7F95A1B496AC72053E7BD5F547EA61932570655A5899
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=333333&bgTextureHeader=diagonals_thick&bgImgOpacityHeader=8&borderColorHeader=a3a3a3&fcHeader=eeeeee&iconColorHeader=bbbbbb&bgColorContent=f9f9f9&bgTextureContent=highlight_hard&bgImgOpacityContent=100&borderColorContent=cccccc&fcContent=222222&iconColorContent=222222&bgColorDefault=111111&bgTextureDefault=glass&bgImgOpacityDefault=40&borderColorDefault=777777&fcDefault=e3e3e3&iconColorDefault=ededed&bgColorHover=1c1c1c&bgTextureHover=glass&bgImgOpacityHover=55&borderC

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\black-tie\theme.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (1382)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):18020
                                                                                                                                                                                                                      Entropy (8bit):5.077568249061877
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:XsvusVoEH6u5F5fyA7F4EcItpog2rgmB0iBfT9RhS2wV53skuMaaSQhQz0iIhKPT:Xsvu/sF5fyzE+DS25Plak
                                                                                                                                                                                                                      MD5:306C70C02BB94F2FE6365BEB055BE475
                                                                                                                                                                                                                      SHA1:2C44EA8724D921ED0727013AFFF16FB9A2B14B27
                                                                                                                                                                                                                      SHA-256:598AC7113B48B1FB114DE7DBCA0345A46623EC632238FAD2F32F46DCB5FD5374
                                                                                                                                                                                                                      SHA-512:31049FA51EAB36D6E7E5F806D1E59DB021CA3453CD3FD5E64AB05276F1CFE4B9356979DE6BDAB7FBCB8132F8C76F77E437624C044BFB3C08188DA4924B7A8632
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=333333&bgTextureHeader=diagonals_thick&bgImgOpacityHeader=8&borderColorHeader=a3a3a3&fcHeader=eeeeee&iconColorHeader=bbbbbb&bgColorContent=f9f9f9&bgTextureContent=highlight_hard&bgImgOpacityContent=100&borderColorContent=cccccc&fcContent=222222&iconColorContent=222222&bgColorDefault=111111&bgTextureDefault=glass&bgImgOpacityDefault=40&borderColorDefault=777777&fcDefault=e3e3e3&iconColorDefault=ededed&bgColorHover=1c1c1c&bgTextureHover=glass&bgImgOpacityHover=55&borderColorHover=000000&fcHover=ffffff&iconColorHover=ffffff&bgColorActive=ffffff&bgTextureActive=flat&bgImgOpacityActive=65&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\images\ui-bg_diagonals-thick_75_f3d8d8_40x40.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):471
                                                                                                                                                                                                                      Entropy (8bit):6.7049806814793484
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7egU9+KOp7UknnhJJCKHh/lzS+E3V+2EMiVw9:X9+5p7UknBRBNzjE82EMr
                                                                                                                                                                                                                      MD5:B58EEB6905F1DAE619D559C85401D8B0
                                                                                                                                                                                                                      SHA1:CFEFCE2277F8EAA63F8C9B05DBCE40A2004D2335
                                                                                                                                                                                                                      SHA-256:35E18EE04B19399AD8F10DCFA7C87CC34A651C86BE4FC8FE1FB436945A222FFD
                                                                                                                                                                                                                      SHA-512:132277DC65EE61A38D67F8AA92ADE513DA9407AB90542D29645CCC317F45CEE10B0616FF443F2D45878B3A59E00A480733F84B0E9C35ABC75677AB9A5C4A6C03
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDATh.....0..a@.f(.J..2..7.F4HiR..K..t..U........m(..:.s...?.....N~.E0........U2^W.!x.J&.]..*..r7...&0.Z..E0........5..P#..Uz..-R.V..R.`.T..Am....0.Z.S..0...=P%}..R..E.6.I...G-.....MM.......~.}.S.`.T..A.............%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\images\ui-bg_dots-small_65_a6a6a6_2x2.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 2 x 2, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):266
                                                                                                                                                                                                                      Entropy (8bit):5.610835048236541
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPg2pUyKOkHkNtF6oXmj2zgN+E3VKF2EMiVAVTp:6v/7I2pUb9j2zS+E3V+2EMiVw9
                                                                                                                                                                                                                      MD5:514220F4C236074C7FAED6FE1C61D0F2
                                                                                                                                                                                                                      SHA1:47FC23159EBD07EFD56CED673588FDEBFC93A411
                                                                                                                                                                                                                      SHA-256:9118A1D5AFCD3E5295F40A64E8055E751E0F1BF60CE75BC6D62945EDE01AFA2C
                                                                                                                                                                                                                      SHA-512:1220D03411CF36FD1943848EDF867A8CD0FCB664CA939DB447C3A9490369C85B7D6DE8E6EEE10D4F1DFA03BF30B3B739A5BD17108A6F2F3A3958F1313570ED51
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............M......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."........IDAT..c\......AV.......l.n...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\images\ui-bg_glass_55_fbf8ee_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):398
                                                                                                                                                                                                                      Entropy (8bit):6.489244714170791
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7J1r+U9+d5IpGI9vAvTMbubI2zS+E3V+2EMiVw9:krr9+TIpxWTMbudzjE82EMr
                                                                                                                                                                                                                      MD5:D93B9B26FC8C0C5959B707DA1E45E788
                                                                                                                                                                                                                      SHA1:813E0CE3C904F5702A8FA7975D5064347DF601EA
                                                                                                                                                                                                                      SHA-256:DD54BDDEF4B35E2C3F7AACE9527EA022E6D0CC02A54178F4526045EB4C947900
                                                                                                                                                                                                                      SHA-512:06064F68BC510447E9960469D9AA90D6F08B547184DA0DC98277C0D265CC429D85270600B6F9D8F5496384B8CE54A0D1E25318D40E0748480A794C5E59B811E7
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDATH.....@.....)D...6....u..%,...i.@&...M,\ B.I..p...U_....ln....(......I7z.B.\...,,q."X...%3Wae...G85N.d..6...a.^.bp..wB.....GAH..EZQ..|.pz(/.*.....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\images\ui-bg_highlight-hard_100_eeeeee_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):316
                                                                                                                                                                                                                      Entropy (8bit):6.004377221346415
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPedUyKOkNQFicpa4b+Npj2zgN+E3VKF2EMiVAVTp:6v/7WdUkF6c+NpyzS+E3V+2EMiVw9
                                                                                                                                                                                                                      MD5:15685D4DCE0B8FFF8B3810B016383823
                                                                                                                                                                                                                      SHA1:053F0D670552C5D15AB78A41A02974715D0A416C
                                                                                                                                                                                                                      SHA-256:D06EC7B51177FDB1ABF190EBA73D582FD0985E50E769AF19F9446D5D70CEDC55
                                                                                                                                                                                                                      SHA-512:57E111F28AC6F71CC460D290464F9216E2298A25DFF7E20E7B60DBD24F7FEFEEE99131D1A6ACF47182831A6557FEBE719288849EB782418FE0D1EA5233E498CB
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......DIDAT..c.....0p.=...?$...0.7b...._.......O.L....;3.?......u'......u...y.....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\images\ui-bg_highlight-hard_100_f6f6f6_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):316
                                                                                                                                                                                                                      Entropy (8bit):5.9763265231364215
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPedUyKOkNKgQiPkpP2zgN+E3VKF2EMiVAVTp:6v/7WdUj/Po2zS+E3V+2EMiVw9
                                                                                                                                                                                                                      MD5:B9D37A48EBD94443F5C3E2822DD090D9
                                                                                                                                                                                                                      SHA1:55100A616B47D71C9E438D9061438B2A706F7BFA
                                                                                                                                                                                                                      SHA-256:2358CD25032A62FD31EC70B69DF51243019A7EFC155D8A1507B5411355F8417B
                                                                                                                                                                                                                      SHA-512:FE43ED77F5D635F73761AFC40178B37C34D29B1CF0CAD29D55FBB6DA644C2E335F0D4DF5EAB6FF13D324E707FD01B8DB5C50B8726D95866F419F4B31CBAD9E2F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......DIDAT..c.....0p.;..%......0.f`....K...T..b.?.0..b.~..a).w).o....L.......k.....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\images\ui-bg_highlight-soft_15_cc0000_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):385
                                                                                                                                                                                                                      Entropy (8bit):6.424213165792157
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7WogU9++Mef7VkGTqOgzS+E3V+2EMiVw9:no19+7ef7TTyzjE82EMr
                                                                                                                                                                                                                      MD5:14A6FE8CCD61F8625F5DB721CBC48424
                                                                                                                                                                                                                      SHA1:DA6981BB8CE4F183C5954B9840C24F75A4E7A69D
                                                                                                                                                                                                                      SHA-256:78C17A090E9CF7DC82BB4E51A760015E73734EC2DA03730EF585BA52A92C0EF8
                                                                                                                                                                                                                      SHA-512:264750DD734D000458706FD32340B8EFF021FEDA7FE2F5E925C2F5009A1EA1EDCF2C47A515798BCA8F2003221210AFB2D1D5BDC1D6E72F4C8FFE96DE07FD7758
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(..;..@.Dg..,l.....4...t.5.t......|)....T.....y=...$..>..V..h.D..D.EMm...w..LK"Y72.j.&.%..&.Hz\..X.8?.V._Pw.s..9T.2o...|..../.`..?.7...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\images\ui-icons_004276_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.74148520890888
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:kNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:uHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:265053FC5F278803065C40324D689469
                                                                                                                                                                                                                      SHA1:2AE551B825ABF8171B75BFC51D4F13447381FC3E
                                                                                                                                                                                                                      SHA-256:4F6176A29AAA41A97A732AB8071DD9C12BBE85502EFADBFDB5814146DB5C7408
                                                                                                                                                                                                                      SHA-512:2917C7518C6E4624BC0C3816B34135CDCAEB1833B129568BCE3A812364EB0E822B131F44F4921FD42F46452668DEE6442EF251DCEF1564505AAD33860937B685
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv.Bv..A4...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\images\ui-icons_cc0000_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.702553996522658
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:NNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:dHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:43C9C3B95C08C992741D28AF12E36597
                                                                                                                                                                                                                      SHA1:0F8640441757AC39626E42E6072B5E054F3523D9
                                                                                                                                                                                                                      SHA-256:679FD5C7A9307B11B44F72140129D489B2CDA77C9001CCAE7FE7C564534FBA5B
                                                                                                                                                                                                                      SHA-512:2D0BA16FAF9239D809E3C05C5561CA7F838CC013FB71357D83A1BC321B97D8DFF4F7F722E051767DD8336ABDE86DEF3BF569FE69FF485EDC959104F8F69080DC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.............................................................................................................................................................................................................................................................................................................xS....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\images\ui-icons_ffffff_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):6487
                                                                                                                                                                                                                      Entropy (8bit):7.90376532755891
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                                                                                                                                                                                                      MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                                                                                                                                                                                                      SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                                                                                                                                                                                                      SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                                                                                                                                                                                                      SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\jquery-ui.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2363)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):36567
                                                                                                                                                                                                                      Entropy (8bit):5.275179603321093
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:10OW0zW61rCliJI5bZb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMEA:2Q3iZb/+vaW1e07CfF5fyyEpDS25mCM
                                                                                                                                                                                                                      MD5:BDA6B84BD307940ECFBC26AD9C5F8D8B
                                                                                                                                                                                                                      SHA1:0BE54254B17821EE818E3384C34DB140F01FBA8E
                                                                                                                                                                                                                      SHA-256:0EACFB8B5C21F4E24DD4B641EC9D3A02A3AD5C22CE0ACBBDDE88049B62CE6558
                                                                                                                                                                                                                      SHA-512:5CC2479EDE5824DE6EFD5FBFE8065D2D6FEF494701C49A6CDDC1FAB5B5B984A30F03AFA2AA7B1412933817E5F6C4839242B761458A733324B37276FEE0C9EB8C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Arial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=cc0000&bgTextureHeader=highlight_soft&bgImgOpacityHeader=15&borderColorHeader=e3a1a1&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=eeeeee&fcContent=333333&iconColorContent=cc0000&bgColorDefault=eeeeee&bgTextureDefault=highlight_hard&bgImgOpacityDefault=100&borderColorDefault=d8dcdf&fcDefault=004276&iconColorDefault=cc0000&bgColorHover=f6f6f6&bgTextureHover=highlight_hard&bgImgOpacityHover=100&borderColo

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\jquery-ui.min.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (29518)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):31305
                                                                                                                                                                                                                      Entropy (8bit):5.217186999993763
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:2Q3iZlcR8lOXHc11ev9/nz1mzn+4c6GX9NISc7nfZBhVb0u:XiwXHcE9/nzgvc6GX9NYBhn
                                                                                                                                                                                                                      MD5:37CCFA3CD39F71C0D6F05D8F1F3BE4EF
                                                                                                                                                                                                                      SHA1:FF286271B64BE28ECBAC62BAB9D2DAA815294737
                                                                                                                                                                                                                      SHA-256:70687998314C27942EA241BBE9929C05ACAD1074DC1C93A24D7872C70A241319
                                                                                                                                                                                                                      SHA-512:4AC26AFA617A491F8D4791A2CE05425110F7F5D2DF1D983630E244E5EA06523D299B731CCF4BB1A37EF4A42F372FBFA19EBC615E471978E712389AE3D2B50B68
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Arial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=cc0000&bgTextureHeader=highlight_soft&bgImgOpacityHeader=15&borderColorHeader=e3a1a1&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=eeeeee&fcContent=333333&iconColorContent=cc0000&bgColorDefault=eeeeee&bgTextureDefault=highlight_hard&bgImgOpacityDefault=100&borderColorDefault=d8dcdf&fcDefault=004276&iconColorDefault=cc0000&bgColorHover=f6f6f6&bgTextureHover=highlight_hard&bgImgOpacityHover=100&borderColo

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\blitzer\theme.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (1364)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):17913
                                                                                                                                                                                                                      Entropy (8bit):5.0738958492108
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:XJW61rCliJI5bEh2UO2VFF5fyVj5SvEc+1bqyQagmB0iBfT9RhS2wV53skuMaaS0:XIQ3iKfF5fyyEpDS25mCM
                                                                                                                                                                                                                      MD5:B16AFD83FDE3A4441D2014186A13862D
                                                                                                                                                                                                                      SHA1:BA5CE93C86044EA086F3D6FC40A01BD36801FB00
                                                                                                                                                                                                                      SHA-256:A81FC809E067BE4F135446F6DBE947D2057DA16924E9680467167C7676D47FBD
                                                                                                                                                                                                                      SHA-512:D5EBDD4E550BBEABEAF75513B5FDFEE2A9B80C1B440799B6B63825160F3920F1F929BAFA441A9A5AF76E2B998180A382B5780CFDEA983A56C997FD287AE1C289
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Arial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=cc0000&bgTextureHeader=highlight_soft&bgImgOpacityHeader=15&borderColorHeader=e3a1a1&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=eeeeee&fcContent=333333&iconColorContent=cc0000&bgColorDefault=eeeeee&bgTextureDefault=highlight_hard&bgImgOpacityDefault=100&borderColorDefault=d8dcdf&fcDefault=004276&iconColorDefault=cc0000&bgColorHover=f6f6f6&bgTextureHover=highlight_hard&bgImgOpacityHover=100&borderColorHover=cdd5da&fcHover=111111&iconColorHover=cc0000&bgColorActive=ffffff&bgTextureActive=flat&bgImgOpacityActive=65&bor

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-bg_diagonals-thick_90_eeeeee_40x40.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 40 x 40, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):380
                                                                                                                                                                                                                      Entropy (8bit):6.468213795058188
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhP0CUyKOkZGjpHrlcFtgNxC7eGoEJByG2zgN+E3VKF2EMiVAVTp:6v/7MCUjGjpLlcFtsEyG52zS+E3V+2Ek
                                                                                                                                                                                                                      MD5:254973041F2F3FF094034CF79E1DD669
                                                                                                                                                                                                                      SHA1:4CC6098DDCD7ED82D12A426903597135E70BDF94
                                                                                                                                                                                                                      SHA-256:87FB6CDDADBE598544359DB6A8C084C5576A82122C4877D6BCF235FC9E0304EA
                                                                                                                                                                                                                      SHA-512:E55C11AD7D6790FC3B65D3539236FA099791B8974DA49BCD5BB265343A5EFBB4D5312C9CB3417AA66C876DD1A3BBD6BB9F7047D066CAB00C2A048F5CE8E4BAC1
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...(...(.......;.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."........IDATH...1.. ...g&..9{...8v.."....7......C=.hI>.......)...'..I.V.....Z1.[6.s...&...Hq..8.XN2..|l..Oc...Sa,...!3..N.s.).).)..S~.)7x...[.T...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-bg_glass_100_e4f1fb_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):408
                                                                                                                                                                                                                      Entropy (8bit):6.53300658338152
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7J1r+U9+BX/ut8OWIlavzS+E3V+2EMiVw9:krr9+BpbIlKzjE82EMr
                                                                                                                                                                                                                      MD5:CEC0B018D99CE30327D69D3C4FAACA11
                                                                                                                                                                                                                      SHA1:8FF0F4BA794B38F968D84C037DA4640AC8284EEF
                                                                                                                                                                                                                      SHA-256:DC094D8BFAC52D7F488851A2BBAF0C87D22FCE9B582357B012030F8CD9905F81
                                                                                                                                                                                                                      SHA-512:3D8F0C7DA9203A946AAF9E211C29BAF053D13A5125A8DF7040A1A8008DB2F18C56C9AA705427769D572E2F7C05A5701FA7E1C313A05BB922BEC45A9F18690E85
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDATH.....`....y.$.Q..0..d.b0...z"...,.;.....a8..|......c..o...7^.jg.....(..m.e.4..a.=a......p..b..5S...Y...Xv...<.p......{B../..z...b.0a..`.>:.1.(..C.I./.b.....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-bg_glass_50_3baae3_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):394
                                                                                                                                                                                                                      Entropy (8bit):6.428194654529718
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7J1r+U9+rX4uXpVsOiIENIzS+E3V+2EMiVw9:krr9+Mu5V6IENIzjE82EMr
                                                                                                                                                                                                                      MD5:BB06E6A2F7440CA2A11050057FE7926D
                                                                                                                                                                                                                      SHA1:8C66858D8FE1968DFC47EFF20071419BCE199A28
                                                                                                                                                                                                                      SHA-256:297D55F5A34F5F3B6CE0E5E7452CA5657220E24B0A6579B833199C102E747E96
                                                                                                                                                                                                                      SHA-512:FDF6D59296056B5D0D080D7245F782CC692D84A0C6843EF5F061BB7187942F68DC641D9C281A556CC6BF33C49F2F484956EE0A76A256CD644384ABFDC7727DD0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDATH.cH..{..&&......Qj...F.Q....e...Jdb.f\.h..R...P..r.i.c.....u..L.,L...!..&.t....Ll.L....X.211.db.c..8........LL.....L.....|....(5J.R.G..2.!TT......%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-bg_glass_80_d7ebf9_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):404
                                                                                                                                                                                                                      Entropy (8bit):6.478097767551162
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7J1r+U9+0B80mmp1tqzS+E3V+2EMiVw9:krr9+0STzjE82EMr
                                                                                                                                                                                                                      MD5:286B528907DFBC11DC44A4CC89681635
                                                                                                                                                                                                                      SHA1:BB075DBA4E783299AC06F110BFD306687D8ACF7B
                                                                                                                                                                                                                      SHA-256:E240FA34AA81B5D4C07650F52C4365E15477DE775F19D12F9B66068A909D1C75
                                                                                                                                                                                                                      SHA-512:DE9F032CB8CCD1AECC56F27A1FA49B5126E9C26F776247551FB766A21EF2303CAE2845A3609F2D721ACA1553FE0AAED93748FA6B07CF65D0300E769B27E7EF77
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDATH...!........fs.jpc.5.4...l&...08N@2;<..71....A.H..N.......w.....0.o.4-.....N..8B.....3dN.k.......]..+<1....2..|^.Z..}unW.....&..k.E.}t."m...C>B3.N..L....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-bg_highlight-hard_100_f2f5f7_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):390
                                                                                                                                                                                                                      Entropy (8bit):6.505409455044373
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7WogU9+BF1J67j9szS+E3V+2EMiVw9:no19+BPw7pszjE82EMr
                                                                                                                                                                                                                      MD5:DC0A7DD2653B260113C92C1936198B21
                                                                                                                                                                                                                      SHA1:D4B267AAFD2A80DD47F11448D0AFB31688573D05
                                                                                                                                                                                                                      SHA-256:10A05D8BE2E8C53FF0BA522E023D6ADF89F5A613F2DA25DC8AC05EB727276853
                                                                                                                                                                                                                      SHA-512:C9AFD3D5618BF84CF76E0D73F3764798219E35FB8BB25BEA22C91374C0FDFFE41D5AFBCBD7F9E8C550C1DC2A0FD28D9C5F2C93377A54261E9ED433A41AAA4F20
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(.....@...?...P..fAT!.q..Y.....A!....a.D..w..&0....>...f.5..?.h.H....,.g.">.F.....jm..J..?.#f......C....d:......k..v.S..4....O....C.,MK....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-bg_highlight-hard_70_000000_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):310
                                                                                                                                                                                                                      Entropy (8bit):5.946430929652425
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPedUyKOkomhhPhgTljzAiyG2zgN+E3VKF2EMiVAVTp:6v/7WdU/VqlzHyvzS+E3V+2EMiVw9
                                                                                                                                                                                                                      MD5:3AD15B0B6700A003DABEB7052E80BE64
                                                                                                                                                                                                                      SHA1:B0E9C09B2F1621EDC0482CFA6474F0FF1E123031
                                                                                                                                                                                                                      SHA-256:4872389BEA563094492E06B11519EAF3F1A3FFA2EE8FF1F05BD2737B8D6FB728
                                                                                                                                                                                                                      SHA-512:2F852E50D491F6353A7F005BCC2A2FC9E4C391C2E0FA184F10EC92BC8C7D72BAC77513E2CA19A314E375EDC57E8B6269CE00B0EFE02A830B333AA67E88E52896
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......>IDAT..c.neb`.0......_k.~.2..2}......w-.o....L..1.h1....t.a.........<....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-bg_highlight-soft_100_deedf7_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):445
                                                                                                                                                                                                                      Entropy (8bit):6.748188273788987
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7WogU9+fZVCDygfx6n+PnrtT1pA+nzS+E3V+2EMiVw9:no19+fu3fx9nZjA+nzjE82EMr
                                                                                                                                                                                                                      MD5:C04E9AD1E86CED01D2295FA5DF2D7B56
                                                                                                                                                                                                                      SHA1:039C02919B57BFF2C4DF3A5A6AB8C50AC547D1A2
                                                                                                                                                                                                                      SHA-256:7A101E445F20FFA93CB93B02A89368C92A9090CD8637DA607FD1874EF7418BE7
                                                                                                                                                                                                                      SHA-512:F671FDCD62BB305713E16D98435124F784DA3F95325A3546E6D9D37F34C7FA606B61BD23DD8B0F3F0A6D3D5CC40CB80B8CD573BF3AB35DAC1EF6BF27262289D4
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(..=j...@...t)..N...P..t...%..=C...frw.EL.v).@E..mH......P.......Z._......*Q.....1......U9...u1mB.va6......._...u..:a{...h.O..*.U}.&..v..>2.5p......M.+.:.M.....u..1..>.V..A.../.9../^d...c...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-bg_highlight-soft_25_ffef8f_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):367
                                                                                                                                                                                                                      Entropy (8bit):6.40916101784247
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPeogUyKfp5EiBRq9l+4uMxfqVH4IWFGT3i+GPuObzgN+E3VKF2EMiVAVTp:6v/7WogU9+Qqk4pCKIWFGT3dGPuObzSl
                                                                                                                                                                                                                      MD5:870E4DA769784845BF381570AC584621
                                                                                                                                                                                                                      SHA1:9BAEC551921D43CB38F47303ABF9ABF8251B26BD
                                                                                                                                                                                                                      SHA-256:EA1D0790F41DE22703A5C96388E57C3646B597DCA181D9A0B9D3D729ADEF1D99
                                                                                                                                                                                                                      SHA-512:3D027DACE55050E0A5A166E6B2FEA9A355626392D858B3FF4D1F5B915FF7F9744A2176E3F34B1534D753AF93EFEF26BA0AE087920F448919ADED54701039B5D8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".......sIDAT(.....`...W.>...&r..[.nK..z.. .1.<.!..$..0....{)......0..0R~..7...@...k....-I..]L....:........X......_.il..5./Q.6...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-icons_2694e8_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.770267640169761
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:XNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:PHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:A1CE3CC448B059968BB35B71A5C91874
                                                                                                                                                                                                                      SHA1:38D446EEAB80F7FBD7772B215267D6205B96EB39
                                                                                                                                                                                                                      SHA-256:4A7C5EDA027930B4803E24985B3F5EF61E7EF7A5051350BB9E7282843ABA9660
                                                                                                                                                                                                                      SHA-512:FEDE7B7F4A6DF4BA309F1E44E642EF2BA2242B84AB472CD07F582CBBDC02142AD349E4ED8593DBB1B8C6F3ECD2313B32F94C9026C08F131434C3A5722FE3DDA7
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&..&.........ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-icons_2e83ff_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.770844676212274
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:aNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:UHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:DB3B908BD060C6F278FDE9E11B3B94E3
                                                                                                                                                                                                                      SHA1:3F4A9C46377EECDE2C1368EF2B963712B8DF5C75
                                                                                                                                                                                                                      SHA-256:CA8FB2EB9A086B0C170EB61317C91138EC06EA0FEF878B8E24D1F50BF6AF2A17
                                                                                                                                                                                                                      SHA-512:9D27F0E66856343254B4C75969B47B3EBACCD95E63981F18472563D95CB85AE3A1A286187F25DA0AF0996E5C783B8807BABC6C7C6698A180175B06C31A949488
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................).:w...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-icons_3d80b3_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.768766204925428
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:rNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:7Hm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:8370749A3E90577FDB876D72E6935F8E
                                                                                                                                                                                                                      SHA1:19FCD8D21F2C58AF5A00FA7335106A771B1AA04B
                                                                                                                                                                                                                      SHA-256:2B1BB4B957E357AFDCC51BDED83CCCA68E8B714078FD5E8CFD64EB91863A66C7
                                                                                                                                                                                                                      SHA-512:8B7CEAAACF6700C04EC27DB0D17B4F55B02FCE43FD950C2B634275CAE319E0030C10D9D14F89F0A34E479CF257C5166CD34A70F9430675A27405D85D40438E37
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=..=.....(...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-icons_72a7cf_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.77096565541329
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:1NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:FHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:505F6857CBA9AAD738957A7D3BB226A9
                                                                                                                                                                                                                      SHA1:0A3A485514E98964B25F3BD96F2AE4D1AA0BE8B2
                                                                                                                                                                                                                      SHA-256:882C69929DD8EFB562A20CAAA71EE3A068810C1F7A0575BF1D11C0A796A9B1BD
                                                                                                                                                                                                                      SHA-512:CDE1BAA8306545454FFADBE58CF0CE8EBA08A7BF95DDE31CBFD1885C4032107F622E5AB67152040B7C92D5E3E3E42A9B5147EFC8249E90C8AADCBEF9026910B9
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEr..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r..r...^....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\images\ui-icons_ffffff_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):6487
                                                                                                                                                                                                                      Entropy (8bit):7.90376532755891
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                                                                                                                                                                                                      MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                                                                                                                                                                                                      SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                                                                                                                                                                                                      SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                                                                                                                                                                                                      SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\jquery-ui.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2363)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):36724
                                                                                                                                                                                                                      Entropy (8bit):5.280856349526157
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:10OW0wlNIb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHC1j/w:cTIb/+vaW1e07VF5fyVEaDS25c
                                                                                                                                                                                                                      MD5:2DA18ED46C347B06B53DEA4457D1A31F
                                                                                                                                                                                                                      SHA1:669C6DBBB0CCE33E59120BF7A94CE704641A236A
                                                                                                                                                                                                                      SHA-256:31917832E32411F18694AD6F7F10FEE76B7D35D45854E1E146D74A80FAEA3C1E
                                                                                                                                                                                                                      SHA-512:D7AFB9AE8CDCE198F3502433BDECB2927D03747A72C7AAFEB127E5EF04401979F88664BD66679934D4A59CCD573A57816D00D25EB5F2BB2B9F143B4A290587D1
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=deedf7&bgTextureHeader=highlight_soft&bgImgOpacityHeader=100&borderColorHeader=aed0ea&fcHeader=222222&iconColorHeader=72a7cf&bgColorContent=f2f5f7&bgTextureContent=highlight_hard&bgImgOpacityContent=100&borderColorContent=dddddd&fcContent=362b36&iconColorContent=72a7cf&bgColorDefault=d7ebf9&bgTextureDefault=glass&bgImgOpacityDefault=80&borderColorDefault=aed0ea&fcDefault=2779aa&iconColorDefault=3d80b3&bgColorHover=e4f1fb&bgTextureHover=glass&bgImg

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\jquery-ui.min.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (29660)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):31489
                                                                                                                                                                                                                      Entropy (8bit):5.22480275794203
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:cTIlcR8lOXHc11evNtKGzdlmm+4m6G9zKsSc7nfZBhVu:AXHcEN0Gzdw+m6G9zKsBhE
                                                                                                                                                                                                                      MD5:C5518025B115C73BBEB9B8518EC0499B
                                                                                                                                                                                                                      SHA1:6B06059A32FB214AA46167815A71BA15F8485EBD
                                                                                                                                                                                                                      SHA-256:050DE6F1B8AB2984735E3A1F609784ADD67F48CB1780EA013D7B7477A7371597
                                                                                                                                                                                                                      SHA-512:BA0FE9D9F4E7611C7F4DF5602FC7A34D6A256AAF775FEE3CFC52D2F5F29FEC089ACDBC4791210435DCD690EC5B8C93BF5F582B50FB7D1117C1B76D622E1D9DC6
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=deedf7&bgTextureHeader=highlight_soft&bgImgOpacityHeader=100&borderColorHeader=aed0ea&fcHeader=222222&iconColorHeader=72a7cf&bgColorContent=f2f5f7&bgTextureContent=highlight_hard&bgImgOpacityContent=100&borderColorContent=dddddd&fcContent=362b36&iconColorContent=72a7cf&bgColorDefault=d7ebf9&bgTextureDefault=glass&bgImgOpacityDefault=80&borderColorDefault=aed0ea&fcDefault=2779aa&iconColorDefault=3d80b3&bgColorHover=e4f1fb&bgTextureHover=glass&bgImg

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\cupertino\theme.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (1406)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):18070
                                                                                                                                                                                                                      Entropy (8bit):5.08870989379537
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:X6lNX1j/kIIF5fy72KEcUplA5OggmB0iBfT9RhS2wV53skuMaaSQhQz0iIhqc:X6T0F5fyVEaDS25c
                                                                                                                                                                                                                      MD5:3041AB25C76FC2EC2B95B53E5D72C478
                                                                                                                                                                                                                      SHA1:0052879B7208E43635E364DC0A6DEC5A06F92A00
                                                                                                                                                                                                                      SHA-256:A606B8C796400C7763591C45ADCD217BA012A282AAA866C686A7AF4E9675B9F2
                                                                                                                                                                                                                      SHA-512:05D6CC22AD3CAA2E937FE196F070DD984AFEB9CD6EAE67EC3717163849ABC936B731818592039B0AF99ADAB6FE8F125FE354B56718D8EE999D9241DCCE41ADAE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=deedf7&bgTextureHeader=highlight_soft&bgImgOpacityHeader=100&borderColorHeader=aed0ea&fcHeader=222222&iconColorHeader=72a7cf&bgColorContent=f2f5f7&bgTextureContent=highlight_hard&bgImgOpacityContent=100&borderColorContent=dddddd&fcContent=362b36&iconColorContent=72a7cf&bgColorDefault=d7ebf9&bgTextureDefault=glass&bgImgOpacityDefault=80&borderColorDefault=aed0ea&fcDefault=2779aa&iconColorDefault=3d80b3&bgColorHover=e4f1fb&bgTextureHover=glass&bgImgOpacityHover=100&borderColorHover=74b2e2&fcHover=0070a3&iconColorHover=2694e8&bgColorActive=3baae3&bgTextureActive=gla

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-bg_glass_40_ffc73d_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):374
                                                                                                                                                                                                                      Entropy (8bit):6.366478028228076
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPh1r+UyKfp5En6rs3grEM5E7e+Vn0g2zgN+E3VKF2EMiVAVTp:6v/7J1r+U9+6rTFKe+J0g2zS+E3V+2Ek
                                                                                                                                                                                                                      MD5:D54912D131FD1851FA51820E2F4563F7
                                                                                                                                                                                                                      SHA1:F656629566FD2C94EE8AFBAF94B6307C61BD4AE0
                                                                                                                                                                                                                      SHA-256:A1431E3400C4E0607BD04F20FF1E732D86518492BCD86EDFDA8A64D77422C8DC
                                                                                                                                                                                                                      SHA-512:6C213534C64A68C44262058C76D5519E7741980BDB7F8AA57726C943BDD2457845C9D204BC9EC2CA52980E6F388E47F1E13C8543207918CA5A711E63DD50264F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".......zIDATH.....@...}.......f....&..Zh..&..:i.N......O.Z..~kZ.@..A..^.....3..AcZ.TRc.&.....T.A...k..U:...'.z_...0....6..`f>.....A.....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-bg_highlight-hard_20_0972a5_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):381
                                                                                                                                                                                                                      Entropy (8bit):6.406906120742124
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPeogUyKfp5EJTc8RcXoYbaCb3LU+2BZTrn7q2zgN+E3VKF2EMiVAVTp:6v/7WogU9+G8aoYJ3TIK2zS+E3V+2EMr
                                                                                                                                                                                                                      MD5:B0763946132B93BEDA0F1906EFDC591F
                                                                                                                                                                                                                      SHA1:72EFEB7E6DDB671F04484BCE3C8B6A38CA1F6317
                                                                                                                                                                                                                      SHA-256:FB8D6098D06455C35222B54887FBEF199B2FD2284DFB12195DBF0AEA92980493
                                                                                                                                                                                                                      SHA-512:24DC3300CF4B68A6388FA7E63C8E1CA6D11F70D6C4B59699AB5E64F80120BAB71789652458DCBD89F15609F006BCE7AAAAE3F9FACFEA52F2407A0AFB97490E84
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(.....P....m@.Y.3........E...[....@..@...................':.x.w....g(....R'..3.j....i..dZ.2.F..L.#.....j..K.p.51C......6.<...)z...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-bg_highlight-soft_33_003147_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):401
                                                                                                                                                                                                                      Entropy (8bit):6.4893748429272815
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7WogU9+YUKgyOXiP4UqIKlmagzS+E3V+2EMiVw9:no19+YUrQ4vIE7gzjE82EMr
                                                                                                                                                                                                                      MD5:B7CFE8282BA59F5F94BEFB7A30688D0E
                                                                                                                                                                                                                      SHA1:0D1F08900B23BF7464B34EDD54A54D5D83EA3BF9
                                                                                                                                                                                                                      SHA-256:11C3956A49ECF039AEACB25BCD6A97AA55AA23964E1343BE0E99F73BA1952D0F
                                                                                                                                                                                                                      SHA-512:84BEE916CE4CF35AF955A3EBC9EC9E8D1C4CAD75E0132FE4BE8A42A5A63969ABBF66EE5815FC8E3353D9E7FAC4668A3D7AF2CDBB54FC06CEF4111A08C6873475
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(....`.._..Yc..8.S.K.KO.2R9.h......n..,.:.&V_....R..w.....N....j4@Q..0...&.X..3n.=...c`./91.w.......'...<..v....-LX....,...5{..|h.....K?.'..e.h.(....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-bg_highlight-soft_35_222222_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):342
                                                                                                                                                                                                                      Entropy (8bit):6.142862152003425
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPedUyKOk/vt9cG/rPPA1ZgX2zgN+E3VKF2EMiVAVTp:6v/7WdU18g8C2zS+E3V+2EMiVw9
                                                                                                                                                                                                                      MD5:A3437EB76B200E5987417ED57B97A0C6
                                                                                                                                                                                                                      SHA1:36C18C07EF26D2FC01D714F93DBF238BE292AA12
                                                                                                                                                                                                                      SHA-256:B2016DF4E2E19A17838CB87DBB6596C7CE7224F1891825359B92EFB470BBA90D
                                                                                                                                                                                                                      SHA-512:21403F52A34E87BD0C8DA2AE48232E1E3E74B7A7FBFC863DB2FBB2BCFACE97F36ACAA1892734DB680822519CCF837F515974FAA68858F7E06CD545FE2A6D7088
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......^IDAT..c.....@........*..[L.u...g.w...=.....N`.7...1.....L.....c.;...}..:L..1..3..eP.a./F/.bA.$. .;.0...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-bg_highlight-soft_44_444444_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):328
                                                                                                                                                                                                                      Entropy (8bit):6.102952359110676
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPedUyKOkRUNdnnxLzw2FtjG2zgN+E3VKF2EMiVAVTp:6v/7WdUgxLzpj7zS+E3V+2EMiVw9
                                                                                                                                                                                                                      MD5:BC42CD9F99AF4032A166A1433A8B5DC7
                                                                                                                                                                                                                      SHA1:9F0E531F7E09D1F75A9F1967614D05DC2C49EBF5
                                                                                                                                                                                                                      SHA-256:234DF09388C6338E20CE45E4EE46F946284863FE1150290F134504A910C35147
                                                                                                                                                                                                                      SHA-512:C6696458597013CE9B03A98B0DCBBF9919858D1D686B62D8C8BF4920116418367AE968BA4FD185ABC08B895D4B59EE17EE187CE0B5F98BD5F4C2EBEF072962C4
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......PIDAT.....0...5.H...u)...(..4B....3...c6.*......&.9.P#..9.. ..WVT..c.u.....#2D..?...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-bg_highlight-soft_80_eeeeee_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):335
                                                                                                                                                                                                                      Entropy (8bit):6.134607764700383
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPedUyKOk+horavt0CSSZq1ekAYUlr2zgN+E3VKF2EMiVAVTp:6v/7WdUITfSSs3A1gzS+E3V+2EMiVw9
                                                                                                                                                                                                                      MD5:1BEFF10685B7E41D107652442EAA77B1
                                                                                                                                                                                                                      SHA1:E605411EBF86AAF94882ECD0BF7C2C57C94703FD
                                                                                                                                                                                                                      SHA-256:1BD38B24DB181616A1C3EFF5DF444E3D8E33E6C7B620BE748ABE2EECC4A4E240
                                                                                                                                                                                                                      SHA-512:17A7CB46B69FEF95FBB313CF998526FCD2F6895FFCEA69BA90F370F35344B4AD7C7BC217111B63CE1C56188E521CFD786073248B48F32CEDCCE445E35700E3A9
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......WIDAT...1.. ........v0.......8.......W.8s..<.NPE......!.<..IEL......M.\.0..N.%4x_k...-1..W......%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-bg_loop_25_000000_21x21.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 21 x 21, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):378
                                                                                                                                                                                                                      Entropy (8bit):6.463279097928892
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPtgWUyKOkfrE+kPymX7dN33SJzjEIVKzgN+E3VKF2EMiVAVTp:6v/7lgWU1rxkPymXZd3mEIVKzS+E3V+W
                                                                                                                                                                                                                      MD5:3F897551A356A1DA748CD9BAF9F297E6
                                                                                                                                                                                                                      SHA1:023DEDBEAAE7F6CFE6305F66D8951FC12D7704C7
                                                                                                                                                                                                                      SHA-256:87068005C88A9BBF33DFDAE5A6452C81D9932E1061B40BB6C2EBA332BE73E991
                                                                                                                                                                                                                      SHA-512:AE35A9E26016DEA62EF39A3602FFFE15661704351CBC91D6F23C259D7B83E2B18BE586E923DDE9A2332C6023FD909EF1C134EDD7BFDA5FA8BE5FADAE630452FE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...............&.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."........IDAT(..... .D.,._.O...4~.?.q.2.vI.$..."..O3'b.z8.....E|.|...Y..7-..YM.U3....PV..+...hT...s..v...+Gq...5......b<...o...........u.@......%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-icons_222222_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7025
                                                                                                                                                                                                                      Entropy (8bit):7.929805003010536
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:IcH5ZfLGSAsNh7vB1PP0M6hPmBmc8aWkRwP4:xHjLV9b7vbaxNcbdKg
                                                                                                                                                                                                                      MD5:23ACA9C182696DB96FF9EE5BF9601461
                                                                                                                                                                                                                      SHA1:F2FB72129DB2BA61E5E9E572B24D82FB93ACC3F4
                                                                                                                                                                                                                      SHA-256:28D8B65FD4815EBFFB752BEB60B976D22E8BD4004194B8CFDD0E9A14E39814BD
                                                                                                                                                                                                                      SHA-512:F36FE89779D9EEDD2456826125166428824ABD33C999B187F69F976F51A5FAE7A2B286B44C4312B7B920BDBE0F043EBB652723962267489EB0B575EB5179FEC0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD."..b.....tIME.....%...'E...TIDATx..m.%Uy...$.!,h. ,.%..&...@.|I..E.M.r...D.....2;.f.....A^$5...j^.K.@U.....-.wW...D`..|.q..".t>........3}.S...~.9}.<.>..<.yNp..M.)....`...px..h...t%....y.Y...D.^.`..O..r.%`.:.$%...{.....0L.L..?..a|..6.....]A......7P..'@/:.]5JH.&.ay.......2....:.8t..y.....@.....#*'..?..t.;.Yw.m..........{.>|Dg7..\J.{.4..K.......3...t.f.Z...`.7.u7..Y.~f].<.....4m.*..<.%%...{.^.`....FR........l8<...O........h8<...O..........k.2..n..6cL...`>.]=u........$....,`.&.+h..k.6..J_*|.K.0...?@..lx..do..m.]..L.3...0.;......T.E,;...4......t...MO...mP.L..U.A&......e...+..`...8u...].5.7.7.~"....h8<...O........h8<.....]..C8.Y..s....Z..}i.A. ...).s.W...!.m.........z.[.#...R.....\R..{...v..........r.....R.. .?.#..[.|.f....`.........y...).A...-..Q.N..4w....:Kr{.......3...Z.P.!0t.{l.\.Y..wSn.P.IA..Vm..-.R...$y.....sI....@;..e.X...v......Y.v...B....n]g.......W..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-icons_4b8e0b_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.7718687501842405
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:mNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:YHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:853C2373C51B7B7C545D092D4A98B3CB
                                                                                                                                                                                                                      SHA1:12270D908EAF7EC8C1D3491C4BFB00414911ED38
                                                                                                                                                                                                                      SHA-256:FA33C9FAA259211591EA1C144246F1CB01B3CB18FD739FFAAE0A4965B979FF97
                                                                                                                                                                                                                      SHA-512:89CCA39CACFF95B8DE1D1C29B8587EBABB91FCA2F91EAE1F491F3410C7549981E80FBCD188AF7DB63DF94ED7D2BCD301082C50E01B171308F76931EB2CD574A1
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEK..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K....]l...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-icons_a83300_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.745691045674909
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:PNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:nHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:372DD47E50840F48E9098AA30D978A5D
                                                                                                                                                                                                                      SHA1:49F2C2A59C0A53F5400BC19F2F66E516699CDF74
                                                                                                                                                                                                                      SHA-256:5D119EC862AEC3BE0B0722B651C5FEE065AB8255B0DDAD3D01E1A6B929B7DFA8
                                                                                                                                                                                                                      SHA-512:9E24AAE1EE5750587C76145C557117E51A04E4B8EB0A56A4C2A88F11808118E2B33575B25AB2AD062A1B5862DFDFA7EDA2B11F5D15C1CA3DF9927D7DB81498F8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3....g...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-icons_cccccc_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7034
                                                                                                                                                                                                                      Entropy (8bit):7.932139241999848
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:K6OJJxfX8+p4/rF1km/zUCVbGarOXZuphvgXad4:K1JJxPzkFWm7UJZOJgqd4
                                                                                                                                                                                                                      MD5:883030509884C748B039641F5955E85C
                                                                                                                                                                                                                      SHA1:FA1BCF0D7310168CF3DD77A30CB527A31EEB6D5C
                                                                                                                                                                                                                      SHA-256:055799E2F20C94BB0CD60D6AFB71D362DAA66AAE390032AB03C631C92FEC1860
                                                                                                                                                                                                                      SHA-512:830C390394294C460D177FB4FC0D714D05994EAC8FEB5AD98C42876F204C8FE51983C31536C84B3DD6D8DC172E24555BA06E64EFB0BAC60CB3C5C4BFB7235814
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..8_......tIME.....%...'E...]IDATx..m..Wy.....(..R.....%..H.&.x.D..Er.....(.....D..........R....H.R;..H.]B......P.)mIX.b.R.*Ed.a^...w..;...{..s...sf...._..8k....,<...O..mB...F.. .6+.J.(.k....i.V....EG.$.......`....c........al.N..Z..._.)`Jy...<.z...B.7...N\..X.V...).)..!H..."&...!H.G.NP)~r..o.vX3.)...........{.>|DW75.9.z..i..\...2..g..w....*..cO.|o..n....m..By.....j.T&.y.JR.|.{.^.`....(5........l8<...O........h8<...O........:...2..n..6eL.h.`...y......Q.G.$....4`.*.7.^.k...R..>2...=@..lx..o..m.]..L.3_...0N;.......c..N..:...t..0..ny..'.Z....@.e.I.:...&r.....^.l..+..=.........O.5.....'@....px.4.....'@.q.30t..8._...t..../.0.....TW..c.......Q.... . )....?j......Uc...%T..g..l.......8T.K.B...%..A&~..F"....f....`.........u........H.(Z'.a.;PJ.WW]%...y..rs.Y..A>...}.....[(.vV....7pH..@..V...-...$y.....s.....@;..i.X...v.....Y.v...B....n]g.......W..c.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\images\ui-icons_ffffff_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):6487
                                                                                                                                                                                                                      Entropy (8bit):7.90376532755891
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                                                                                                                                                                                                      MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                                                                                                                                                                                                      SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                                                                                                                                                                                                      SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                                                                                                                                                                                                      SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\jquery-ui.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2363)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):36670
                                                                                                                                                                                                                      Entropy (8bit):5.279756253570595
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:10OW07ABb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURH6CrjVb:3Sb/+vaW1e07oF5fyUE+DS25u
                                                                                                                                                                                                                      MD5:9F6A7C59CB79262E433FF8CB4DCB6263
                                                                                                                                                                                                                      SHA1:7FA3C00C899E8F02C5607C070AB03E74E2CEC924
                                                                                                                                                                                                                      SHA-256:E37D1F99DB0795BCA172C98AF91FBDC2CA55806241823916339B6E0765C2D375
                                                                                                                                                                                                                      SHA-512:C32BADA6D271252248F1F8CB9411506617EC4D61666CAF1E4A4440B0AD664B65762F9BF338130005548A89D527404046E9BCBFA5214475D6CC4E336E333F5CC6
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=444444&bgTextureHeader=highlight_soft&bgImgOpacityHeader=44&borderColorHeader=333333&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=000000&bgTextureContent=loop&bgImgOpacityContent=25&borderColorContent=555555&fcContent=ffffff&iconColorContent=cccccc&bgColorDefault=222222&bgTextureDefault=highlight_soft&bgImgOpacityDefault=35&borderColorDefault=444444&fcDefault=eeeeee&iconColorDefault=cccccc&bgColorHover=003147&bgTextureHover=highlight_soft&bgImgOpacityHover=33&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\jquery-ui.min.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (29589)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):31390
                                                                                                                                                                                                                      Entropy (8bit):5.222338758092407
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:3SlcR8lOXHc11evA4zkm++446GpbZ3Sc7nfZBhVz:tXHcEA4z1m46GpbZZBht
                                                                                                                                                                                                                      MD5:AB75E96AD411C10AC315B1C104BDB58A
                                                                                                                                                                                                                      SHA1:101AA2C7A353A19DF8005BA093AA3082B0FBB650
                                                                                                                                                                                                                      SHA-256:7999E267C2C6C051C6CB70E776DEE5EDE2A291BF0383E7767B502F4CFE4D58F8
                                                                                                                                                                                                                      SHA-512:4A0EEB728E6A512E18DF0CEA8F1321339CE3DC326EC672408A574A4734C825E21D57CC529489458278258B778E06AE98BF491BCFA223742BC8A6ABB9E1DD9820
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=444444&bgTextureHeader=highlight_soft&bgImgOpacityHeader=44&borderColorHeader=333333&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=000000&bgTextureContent=loop&bgImgOpacityContent=25&borderColorContent=555555&fcContent=ffffff&iconColorContent=cccccc&bgColorDefault=222222&bgTextureDefault=highlight_soft&bgImgOpacityDefault=35&borderColorDefault=444444&fcDefault=eeeeee&iconColorDefault=cccccc&bgColorHover=003147&bgTextureHover=highlight_soft&bgImgOpacityHover=33&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dark-hive\theme.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (1378)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):18016
                                                                                                                                                                                                                      Entropy (8bit):5.083484636552025
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:XRASCrjVnIF5fyIS70EcS1poqZGgmB0iBfT9RhS2wV53skuMaaSQhQz0iIhn:XRdF5fyUE+DS25u
                                                                                                                                                                                                                      MD5:6D93DC6B49305078CDC92FD8E2F5B068
                                                                                                                                                                                                                      SHA1:1262493B0C501A3452A430E9726F22E23107F73F
                                                                                                                                                                                                                      SHA-256:9EF7AB8ACB7D9D64C5DB0FEBB181051F48DD21B16265CA5A42F6997CA87CF7DB
                                                                                                                                                                                                                      SHA-512:C14F54720D8F01B34D5385DEE986AD013C6608E696D229C159B07EAFDC285DE1A076F81DFA3884DFDCF4D12974E82DDD7CBF07C13361E12452408A40E87A52CF
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=444444&bgTextureHeader=highlight_soft&bgImgOpacityHeader=44&borderColorHeader=333333&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=000000&bgTextureContent=loop&bgImgOpacityContent=25&borderColorContent=555555&fcContent=ffffff&iconColorContent=cccccc&bgColorDefault=222222&bgTextureDefault=highlight_soft&bgImgOpacityDefault=35&borderColorDefault=444444&fcDefault=eeeeee&iconColorDefault=cccccc&bgColorHover=003147&bgTextureHover=highlight_soft&bgImgOpacityHover=33&borderColorHover=0b93d5&fcHover=ffffff&iconColorHover=ffffff&bgColorActive=0972a5&bgTextureActive=highlight_hard&bgImg

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\images\ui-bg_diagonals-thick_15_0b3e6f_40x40.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):482
                                                                                                                                                                                                                      Entropy (8bit):6.731455137882688
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7egU9+AfHu+wsqBaud0rPo3/HayzS+EELEMPS:X9+vXsa5dH3PzjEELEMPS
                                                                                                                                                                                                                      MD5:3FB571A70BAEE9CCF436CB7444655F4F
                                                                                                                                                                                                                      SHA1:FADA5ACBCE5E3417064B121397DD5DAA59EF300B
                                                                                                                                                                                                                      SHA-256:7767B62C04F6012A35581706342FED2D508337E4E56EEF8AB5AC3A0FD28117E2
                                                                                                                                                                                                                      SHA-512:73B79B930ED70A66623572758C5E693827133A56BA7BB96CAD02ACADEF41BE9314B9AF15929AD8B139074D19B8538A9EFA9D39121AF4EB32BA36DB0D31472481
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATh.....A....N. P.....`(.{....T...(.A.$A.Mv.;...g..3y.......2y._...Sf9-....?...j.L.&.lj..@......z.Jz.]..*..rW...*0.Z..Y0........5..P...Uz..[........0.Z.&Q.`.5..R.`65.{.J...M.N.....0...S..0...=P...5..P.E.....0.*..m..q..e!...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\images\ui-bg_dots-medium_30_0b58a2_4x4.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 4 x 4, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):295
                                                                                                                                                                                                                      Entropy (8bit):5.8403310516544025
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhP7TCUyKfp5EJ4/It961yltYDIG2zgN+E8VLEMlVbEbp:6v/7SU9+btFtYczS+EELEMPS
                                                                                                                                                                                                                      MD5:F18ED3A85803A0A5F7AD022481865788
                                                                                                                                                                                                                      SHA1:1036BF67D25712B952886365C3C172D21D1180B6
                                                                                                                                                                                                                      SHA-256:BAA6735F2CABDA61DEBECEDFC1F2D6EC88B80B4D09072E63F513C875DBD3CFFA
                                                                                                                                                                                                                      SHA-512:1ED7C77032A9B4C26C3EA2380E9FFF68CE9F812E27F85C874A8CB36B4BEA589ADA01337E451D688ED3650C2DD3548B79D2DBEBE69F8B404A7AA1213743C9CD4C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............v..j....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x......+IDAT..c..X....0A(...|...E...@.;...~..,............%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\images\ui-bg_dots-small_20_333333_2x2.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 2 x 2, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):266
                                                                                                                                                                                                                      Entropy (8bit):5.450950367736609
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPg2pUyKOkp4/Qk3hjsxzgN+E8VLEMlVbEbp:6v/7I2pUEgzS+EELEMPS
                                                                                                                                                                                                                      MD5:AB212BB03E3F0A9BFC602E66A66A5B52
                                                                                                                                                                                                                      SHA1:0C670C2D8F309DF83B7D751D203CE1B2BA936175
                                                                                                                                                                                                                      SHA-256:70D6178C8CC51943FF7BC50F3B5E9532BB5819A38A2C8AA35A07F90FED30AE7A
                                                                                                                                                                                                                      SHA-512:90B36A53DDE5DF1D845A590AF4670557CE81A7240FA93E65CED9C982694F27B820A65B8E8EBFB538A13D2DA6B07C52356C111D8AFB7C37BC5783224DB0A71A60
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............M......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x.......IDAT..c46f``b`.....8..e`.P...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\images\ui-bg_dots-small_30_a32d00_2x2.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 2 x 2, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):276
                                                                                                                                                                                                                      Entropy (8bit):5.6290628196886745
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhP2+UyKfp5EJ4/izEpllIzgN+E8VLEMlVbEbp:6v/7ZU9+J2KzS+EELEMPS
                                                                                                                                                                                                                      MD5:49BD4C1ECC0B3DE7361A173739B42D09
                                                                                                                                                                                                                      SHA1:79DF813E194FD54B0FF5815E239E0BB63ADAB343
                                                                                                                                                                                                                      SHA-256:D5B2FC96836D2CF7D20F26F934CDAF978C59B08EC1F7B321D5BF23EC92FDC744
                                                                                                                                                                                                                      SHA-512:9DCEC21CE1467B596F63C9D3915CC5FE2435ED5AE2ACC245D6FC1FF852E2B68A325B96AD45FBDD4C00A491AD00421A742AE9FC0F84E2347F10E17BC7F27A1C9E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............DF0....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDAT..c\.XW.... ..K..j../..,..Z....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\images\ui-bg_dots-small_40_00498f_2x2.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 2 x 2, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):282
                                                                                                                                                                                                                      Entropy (8bit):5.635984033684598
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhP2+UyKfp5EJ4/8kl7J7FyHxIvzgN+E8VLEMlVbEbp:6v/7ZU9+CN76OzS+EELEMPS
                                                                                                                                                                                                                      MD5:05D7305DFD9AF99188E21D18C608E250
                                                                                                                                                                                                                      SHA1:3A7C3BB198F46F3B71A539A73407A75C0B8DF223
                                                                                                                                                                                                                      SHA-256:49584E9E9A3D8B1D999E047C3D33E2FA534E5CE08A804B02F52624FBE544793A
                                                                                                                                                                                                                      SHA-512:FA1EDE1473FA1A615173200BE68AD4240FDB5886BC2783E920BFDA0B3687ADD9E8783EAC037737BD613162F0AA943602B06734B9870910A20F9839392614E31B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............DF0....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDAT..cd`....g``````.P.i*..'..*....D.....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\images\ui-bg_gloss-wave_20_111111_500x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 500 x 100, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3990
                                                                                                                                                                                                                      Entropy (8bit):7.891474477620868
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:fcZXXXn8g4P6kNt+zEeY1ICwThkhndsqJamy8rApR+7q+S:04P6Zwp1WIndbsgjq+S
                                                                                                                                                                                                                      MD5:0D7E9BC2B8DB61A4B7A4D55044760EAD
                                                                                                                                                                                                                      SHA1:00323D927D10A18334079F55B5B1A92AB00FACEC
                                                                                                                                                                                                                      SHA-256:5240A391500CF005247EBBB2662044AC85EF065BACB88ECA5D297837D733FD1A
                                                                                                                                                                                                                      SHA-512:BAB006B5CE949D0096648E34C2B290E406111565416E1F2820915EC646364C7643FCD67B61FD030972D9498957DDFCAB9EE3C7FC53CF5CF46BCEA2D461D2C668
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d......<A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x.......IDATx..].......o.*.%.E..D..!(.i#p1.:./.p.C`.^..*F......l1...c...q..{....9U......\....4..... .9.N..A....t...8..b..@'..... 6..t...8..b..@'..... 6..t...8..b..@'..... 6..t...8..b..@'..... 6.=..k?.k.`m3.Mil..-.G.Q2Z.z.Y..z..m]......}.v...8=Q[...Y{.W. b`.k..Am....f3.Ql...}...%Z.....#.^..d#0.(....:._.S..x...K.I..\M[ .km....M..k.+.....R.cF..6._...Y.....$.z2......f...#F.....y^.....f.ki..iP...R.......q.... .........N....4.".o.4..D......)......r.$G..../..tI-;...H[..1.i...*..2.@.E.H.E.;.iF3;..4..i/.H0/.{..G..>G.....z[d'.0z.GI......#..a.Q.C<j...Hy.s.".6........&Rj...NuS./.k.ZOr]o..4.....}.6...C[.1.....Zoc..R:....K..Q....=.....i.md...........f..A{..{.>..j.......].%.....V..8.|O.:-'6.~<.1fc.9).~.. .98.N...'..b..@'...\.}j....o... 6.^....p>||./..#.Q...\b.|F.U...m...x....-.AK;b.\l2....V.....y.3O.B....n...7.\-.8.,.I\...v^.$.,.y..K~...A....

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\images\ui-icons_00498f_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.738397057708785
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:S3NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:CHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:409DB4EA7A4679B64D9903E558897637
                                                                                                                                                                                                                      SHA1:A5BC4583C783DF4AEE4C5B234561FB1C8E4C31DE
                                                                                                                                                                                                                      SHA-256:BB348EFA46AEDEF89A18A0256964A1E17525975EDF9CD442C7E2FD0DD40113F0
                                                                                                                                                                                                                      SHA-512:A5D76876D39182B924FD93ED3B6462C9FA7378184FBF9D19FB0D91CC0CA1EF7CA8C32054168F5B399EAB2F49AF0487CE4887B2C708579F61C601F315F1A5FD05
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I..I.:e.R...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\images\ui-icons_98d2fb_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.778170418989979
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:cNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:GHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:2979CF4F5560012AC1C67573A43D1405
                                                                                                                                                                                                                      SHA1:13BE8F99080E00991795FDEA751353FA8E75DCBF
                                                                                                                                                                                                                      SHA-256:1F1D8BD9D4CDC3919D74287BCD9B3C0A7533E5407D05043C0C2F2BF7D1C0F436
                                                                                                                                                                                                                      SHA-512:21676E992AEE427E3D0A7494B1B8D37E319CEA3FD52519CE8B0D29D2D8489125C6FE9D1A5A2DD494B93523AE0AF56644ADCEABDF8B49EE1F0B56A883817F5142
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE...................................................................................................................................................................................................................................................................................................................ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\images\ui-icons_9ccdfc_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.7732597452877
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:qNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:EHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:99AE47587576A1A15CB7B15C67F3545A
                                                                                                                                                                                                                      SHA1:C6D3E695CAFF3DE7F9EF47873E543E6B0C0FB4C1
                                                                                                                                                                                                                      SHA-256:4015F92E2862926B030463D1D94548059604B362A272CA12E66E5D0A11600635
                                                                                                                                                                                                                      SHA-512:FDD3A8A55AB5F59A7A583C5132C30690EBB67882094E0E895189111BF8AA455E703234E2033F05BFFA141CB617D7E48BA6D8825A069C1874C1136DB24AC99E28
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE...................................................................................................................................................................................................................................................................................................................ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\images\ui-icons_ffffff_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):6487
                                                                                                                                                                                                                      Entropy (8bit):7.90376532755891
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                                                                                                                                                                                                      MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                                                                                                                                                                                                      SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                                                                                                                                                                                                      SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                                                                                                                                                                                                      SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\jquery-ui.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2363)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):36540
                                                                                                                                                                                                                      Entropy (8bit):5.279669592134456
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:10OW0XXmLjVnb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHuo:rXmVnb/+vaW1e07qF5fyEECDS25ulak
                                                                                                                                                                                                                      MD5:008B2CC14D63BAAD9AD3ED34F27BA400
                                                                                                                                                                                                                      SHA1:978BF40F9CA08495E0DF2150890AAA20B6BD03F5
                                                                                                                                                                                                                      SHA-256:9CC15CFC0AF0DEA3577DE02C4C5710868B84DA3D32FE8A5A39EAE1E87C336DA7
                                                                                                                                                                                                                      SHA-512:7363DB6DE432B0A6F763FD05BB6469D6FCCAFFC7DDE22684469DA3D336AF58663F93B69601682D8FE4FBB7817F1714AC29A963FBEA9D993A9085B7849B41AE10
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Arial%2Csans-serif&fwDefault=bold&fsDefault=1.3em&cornerRadius=4px&bgColorHeader=0b3e6f&bgTextureHeader=diagonals_thick&bgImgOpacityHeader=15&borderColorHeader=0b3e6f&fcHeader=f6f6f6&iconColorHeader=98d2fb&bgColorContent=111111&bgTextureContent=gloss_wave&bgImgOpacityContent=20&borderColorContent=000000&fcContent=d9d9d9&iconColorContent=9ccdfc&bgColorDefault=333333&bgTextureDefault=dots_small&bgImgOpacityDefault=20&borderColorDefault=333333&fcDefault=ffffff&iconColorDefault=9ccdfc&bgColorHover=00498f&bgTextureHover=dots_small&bgImgOpacityHover=40&borderColorHo

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\jquery-ui.min.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (29509)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):31287
                                                                                                                                                                                                                      Entropy (8bit):5.2226618941796215
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:rXmVnlcR8lOXHc11evMf+8mzkmAW+4x6GpCqISc7nfZBhVFWGc:sOXHcE58mz1AOx6GpCqYBhM
                                                                                                                                                                                                                      MD5:2305D06C48CA0D210D8A3DAF72019233
                                                                                                                                                                                                                      SHA1:278E6B52466C2A13308D94DA327DC20D4048B2E6
                                                                                                                                                                                                                      SHA-256:B5914589E58247E40B3D224AAB415A049674B5EC805C13E6A0D41F871FE9F9D5
                                                                                                                                                                                                                      SHA-512:8466242B348C59A296274306215CB787C0E4D55944390851E0D141D7C8C7DCA092CCE847E5983A4F9E1FE76EA77BC79955396714C722798ED995A77D82527D33
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Arial%2Csans-serif&fwDefault=bold&fsDefault=1.3em&cornerRadius=4px&bgColorHeader=0b3e6f&bgTextureHeader=diagonals_thick&bgImgOpacityHeader=15&borderColorHeader=0b3e6f&fcHeader=f6f6f6&iconColorHeader=98d2fb&bgColorContent=111111&bgTextureContent=gloss_wave&bgImgOpacityContent=20&borderColorContent=000000&fcContent=d9d9d9&iconColorContent=9ccdfc&bgColorDefault=333333&bgTextureDefault=dots_small&bgImgOpacityDefault=20&borderColorDefault=333333&fcDefault=ffffff&iconColorDefault=9ccdfc&bgColorHover=00498f&bgTextureHover=dots_small&bgImgOpacityHover=40&borderColorHo

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\dot-luv\theme.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (1355)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):17886
                                                                                                                                                                                                                      Entropy (8bit):5.081970292059026
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:XNXmLjVUTDziAF5fyWy2EcA0prtOIgmB0iBfT9RhS2wV53skuMaaSQhQz0iIhdlR:XNXmVgF5fyEECDS25ulak
                                                                                                                                                                                                                      MD5:2E88AB19BF92243A51E13D0B6CE0EE7F
                                                                                                                                                                                                                      SHA1:AE106A36C01FB6B08538B69AF49B60BB4E7823C4
                                                                                                                                                                                                                      SHA-256:687AF36230D585492083648BC22EB68A1E27990716B420BD1884415A9D74D888
                                                                                                                                                                                                                      SHA-512:4E4CB4D91FCB5BF711E295D32529FD45FDF29AFB72029A30CEF224BDA53C294EA92EB2F224B1769E7BB10E64AE68FF0B036CD282BDA702FE88AFE1D6114E4901
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Arial%2Csans-serif&fwDefault=bold&fsDefault=1.3em&cornerRadius=4px&bgColorHeader=0b3e6f&bgTextureHeader=diagonals_thick&bgImgOpacityHeader=15&borderColorHeader=0b3e6f&fcHeader=f6f6f6&iconColorHeader=98d2fb&bgColorContent=111111&bgTextureContent=gloss_wave&bgImgOpacityContent=20&borderColorContent=000000&fcContent=d9d9d9&iconColorContent=9ccdfc&bgColorDefault=333333&bgTextureDefault=dots_small&bgImgOpacityDefault=20&borderColorDefault=333333&fcDefault=ffffff&iconColorDefault=9ccdfc&bgColorHover=00498f&bgTextureHover=dots_small&bgImgOpacityHover=40&borderColorHover=222222&fcHover=ffffff&iconColorHover=ffffff&bgColorActive=292929&bgTextureActive=flat&bgImgOpacityActive=40&border

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\images\ui-bg_gloss-wave_30_3d3644_500x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5999
                                                                                                                                                                                                                      Entropy (8bit):7.691482100292732
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:fHClGlTr0BkxPKNexG1FUtdLdkQZVRm35XN4eyVI6yYGcTU/gF6FrM4B98625srx:PCMhxPKydkcVcBN4eyLyYGcQ/HpM4B9L
                                                                                                                                                                                                                      MD5:F36FCC39931731535915E2DDFDBF3947
                                                                                                                                                                                                                      SHA1:60BF6CD036594601733C7E8E12CD22033789B2EF
                                                                                                                                                                                                                      SHA-256:3A11AEC8A7D12CBAEE309A9D4C545F8EB64DE46E5C24BFDA11119C40FF94EA46
                                                                                                                                                                                                                      SHA-512:A513886D3B211500FD06AA7AEEE9073D0AE843245B6613DF334A9336FE651096AFBC23EDE8FCEC7E2E361FB86F63B441FCA6DE26E63115542FC05048099ED64E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".......sIDATx..].%.u.{n.".K.^.. .@6....|$..#.Bv%y.rd.F`... !.D.B Y..../..XCp...^.yI......c...=.!.!......<.......OUu....A.[]u..9U]s.....9...}=.........................+..w........;.............`..........pp.....X.8...............V........+..w........;.............`..........pp.....X.8...............V.....a'..Eo...g.l..,....y..OS#m.4.:..r...o...(}].qy....dVQL.Q.Rii.)..U....|}.b....k_.%_+..9kA.m..x..Ea/....j.=1_..=.*.{.I..Gd.....UUb....}...G.t......*........2.zg..ghk9?./W..........p....$.=.....'.B..E.>.8\,.i.B...O).iy.y'5m.......C....;...;..Wo.Y.i..........!...}.|........c.U@&.......Y..;...........*.......pp.....X.f.<\o...U..^h.....Q.];.>};...Y...u.W1.bz..:.J*9..E.G.].!.m_..R'z.s.+.gN.^e...YV.+k.....j..=..]..nJU.){.R-...........(...{.~.K.{z..!..d.K..kA?......x....9..d6-..J....;.>.....a.....m.f'.....t.w...Z.g.m.,{-...y.......&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\images\ui-bg_highlight-soft_100_dcd9de_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):400
                                                                                                                                                                                                                      Entropy (8bit):6.509967114205884
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7WogU9+mu/aCDPqNiGwkWXzS+E3V+2EMiVw9:no19+myzMiLXzjE82EMr
                                                                                                                                                                                                                      MD5:5D491F7B87E945DF741EACB3D368ED05
                                                                                                                                                                                                                      SHA1:E85A361D1DEBCAB83DE799F29ECD4754A518CAE4
                                                                                                                                                                                                                      SHA-256:902CA5DCEB7F066FD3830E81AA40FD261A4BF4F11852D259F557B88051C4F376
                                                                                                                                                                                                                      SHA-512:E6FF0037B706294D556030C4DFE04BA48165F8B2B233BB5BA5C2BCBD71013C466175207EB1C544D9370930D7F42C2527185EF873E9D7B512085965A2347DEFB9
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(..;..@.........A...ZXY...z...6.H$..iu%..~...'P........o.;.$.o.R.Znt;...i...1ce.$L....h..:...x..9.h.....7..>l8.[..c)..7..U.8//s.eQ..._.qx..Ml:.......%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\images\ui-bg_highlight-soft_100_eae6ea_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):431
                                                                                                                                                                                                                      Entropy (8bit):6.629498745211216
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPeogUyKfp5Eil1m0UFAQNy7VtY70PkBJyj2zgN+E3VKF2EMiVAVTp:6v/7WogU9+2s9ynY4szS+E3V+2EMiVw9
                                                                                                                                                                                                                      MD5:0833FE23D64DB51677CB9F8BEF35E10F
                                                                                                                                                                                                                      SHA1:61528D6334E88224E13B309F524CB01C5DD29871
                                                                                                                                                                                                                      SHA-256:F08B09D7F06D2E57475985191A7EED6046022A218B7238E8F51D43E786E34E18
                                                                                                                                                                                                                      SHA-512:334C81EDF50FF9A61C52AA8DEE7DD4EEEAD8A652377FF037BDDF36C3B53D97462A820DA82E04B81FBABAB109D6473222962F7F8E16D157B75C25389FA078131F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(..!..`...}.@`..y....6.' AQ...%..w0p.....&..GD....g.+.fz.>.[...RCB....$.H....&....)z.;..T.^T.e..e.G.s..^.Cv8$..p.F{...#C.p.Z...=^.7.+C.*c^.x.#!b...t[....1.U...!.\.oW.q..bY`.!.;W...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\images\ui-bg_highlight-soft_25_30273a_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):420
                                                                                                                                                                                                                      Entropy (8bit):6.606028187820867
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7WogU9+tSksqcRcltd2d2uSQCGyzS+E3V+2EMiVw9:no19+tXsqca9OSQpyzjE82EMr
                                                                                                                                                                                                                      MD5:C1910C93E28B98D5AE0B2F2B1B04EE22
                                                                                                                                                                                                                      SHA1:F36314A03DEE387C90EDCDD88AE5C6BB1CB484C4
                                                                                                                                                                                                                      SHA-256:65B5314B6F5D2399314FBFF4617560ADEDF496B221E15CC9B5D4B92595D2B28A
                                                                                                                                                                                                                      SHA-512:9BE84A7D68C0E129863F4170B8B6CF0420A2B530703BBA5273AE220455EBCC2F75E755E9256C8EF7AD657506FDFABC2AD82B852FEC3F7DC33CB4DC1C003C1E9D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(....`....0N........D.-........q..................0q.....+.8.-..MEDD..g9.EY....N....Bi.a&.......)3.=...L..(V.`..b.Ee&..Vxhc..H..3Z..9.,.w..p..Q.v.a ..A..~./e.d.z;E...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\images\ui-bg_highlight-soft_45_5f5964_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):405
                                                                                                                                                                                                                      Entropy (8bit):6.462769543492536
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7WogU9+yI9YAi0AaGztnzS+E3V+2EMiVw9:no19+IAibzhzjE82EMr
                                                                                                                                                                                                                      MD5:88961029455F0C3A5066CB34D7814023
                                                                                                                                                                                                                      SHA1:D475886D45EECE8598892B5144F569DAA93114E7
                                                                                                                                                                                                                      SHA-256:D8AD7211C34EAF56349C6D629B4C740947E0F774E2693216155BC820AFC6591D
                                                                                                                                                                                                                      SHA-512:19320CC6EE4E69F57846B847C55B837C2B17409CD019DB1B9108AB5D9437C89017FDD73051FCFC676BC56599B54610309A18131BACEFEC5963E65012884D5F90
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(....A.D.&G...8:....k....6..zN.. .{..g.X...3.M.4...%..dl...k......v.+...^NG.s..\.a.V.Y..g`.c...{..`.)'./a,.Mn..+.....8)+.6z...X.j...zB3M5..K?...Zm....L...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\images\ui-icons_454545_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7090
                                                                                                                                                                                                                      Entropy (8bit):7.925434318681863
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:Tbhz1Ogz+PpLVLuOyc3AJzX/7N/dlbNPtGzQ4gGdBcFk3v4Ql+p23elLTJVaXKkH:NQ3tIOj6/dtFRCMmgo+p/Z9UFAhKDsHW
                                                                                                                                                                                                                      MD5:5C3BA680CC34CD9B30855C180474A152
                                                                                                                                                                                                                      SHA1:91FFCF4A399238C121F42951BA801E7C5030C1DA
                                                                                                                                                                                                                      SHA-256:33EEDA3A7ACEAC3E727FCA686F18E8736824ED4A1FCE72B8952F01EB2356CD77
                                                                                                                                                                                                                      SHA-512:4FD4B8000F8059C5CA9484A3B61EA10C1323110336D924983D3473F489A4FE7E417DB2AF4E02433BFE017831E6B80CC427C00531EACC55BFE6D2501CD2686269
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.E.;.-....tIME.....%...'E....IDATx..k.%Gu..m;....!.^...p.l.0..[..HX..H...:w...8;.........g1s.....].&..<...............C.lfq..!,."....Wu...{.v.Gwn.>U.UuN=..S..x4.g.:...........6!.Agb3.. .6+.J.D...0...&..s..N..._..B..s..&.&..>~.=...c{v..j%.._.D......Y..E...F.q...G..........R.S.C....E...!..'..NP)~..t.=;..w.me.BH{.s...S......&..S..6MCP6.z..!(..hnE.6.Vj.cO..6.y7..i.~fK.......j.T.0....<.2.......6+..^;..4.~%.....px.h8..4.^.../............:...2..n..6eL.h.`~..=u....p.....r..n.0s....Os.....Wr...G...h. ._..C..mz.-..=.)w....Fi..#...@u-c..P...O.{.S.s.^|B..A.'m.TQ.....n.`..[.......|....t.7.^..p......@........px.h8..4.^...s....C8.U..k....N..}..A. ..*..s.%......~...a.JYT}.-....1..pT..V..P%.%...?p(.>~.PA.E..........]..1.^.....(...[#....\....WR..>4j"m.h...I.@I.>]...y.........A6...........E:..q7.......n..05A...uP..y.L.8.Pj....K.9.[...E.Z............L...u.....L....;X

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\images\ui-icons_734d99_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.778147156719075
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:kNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:uHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:049AE0FA0D5115E50A85DAB704272EE5
                                                                                                                                                                                                                      SHA1:0596A3E153C7F8976A78553D6E3BAF492CA1C81E
                                                                                                                                                                                                                      SHA-256:584A79C0AC285D669F287C6AC494AA4549818231CA4C7C37120AA5C872291221
                                                                                                                                                                                                                      SHA-512:CD4FCAF571532AE4F74344BC0261B748482E6CD84AF7FCB8EAF1A71A8A7D823A305042398581A7FEFBC9B764A10B6BBC7B21E538A4E534560094FCC9F5571800
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEsM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.sM.......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\images\ui-icons_8d78a5_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.779787835398036
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:3NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:vHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:1388573ADFE782CDF788544BC92118D8
                                                                                                                                                                                                                      SHA1:3770D75FA62E144B7BC9ED4B1703D52733A99B85
                                                                                                                                                                                                                      SHA-256:46F15CFD2AED013ABC792664D8CD78E0A7F6A76ACEB31A4D4C4688CEC46610FE
                                                                                                                                                                                                                      SHA-512:1D396D2D3FE96FC48413178F9A39075B52A4A8A6DE5D9220484585F096D39ECD8FF3254D0A630F583E1067D0A51C24874D5C2D2439736393AE7548648F31DC35
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..=.....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\images\ui-icons_a8a3ae_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.778042983270137
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:QNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:iHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:EF31D50172093B1F64CFADF1B8292CF0
                                                                                                                                                                                                                      SHA1:0E1173B04F2A1888F5C829179DE59B479F6944AC
                                                                                                                                                                                                                      SHA-256:3D0B1E030A2186F8A5D5FDF83C902908AF76035E43FE2ADC989627B419D226A1
                                                                                                                                                                                                                      SHA-512:3FCD547B4540D4C09F7D9843386DA1B1088FEB5B7E3D219531D7513FA377E75478A74DF58D077AC5BFB864321B31007EBBAF038C9F72732C4B016CFF8A3C1BBF
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..................................................................................................................................................................................................................................................................................................................ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\images\ui-icons_ebccce_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.775735413327992
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:HNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:fHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:6F8710413AA2B910A26426826BB516F1
                                                                                                                                                                                                                      SHA1:DD3286F638EAF535A1797A12DF194195A9E98484
                                                                                                                                                                                                                      SHA-256:8A9CD6D04D46342763433F96D2B96B14C73F39AA5183D22A68C18F5BCFCBF929
                                                                                                                                                                                                                      SHA-512:5E8201C9140EA10C5951CB4D5299BDCF9B893068250C5730D1FDFB35D567DB37D304B0BBC8C6842244319D092C563514E40AD2A5398F749D7EB7E0D600B31EB3
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.............................................................................................................................................................................................................................................................................................................J....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\images\ui-icons_ffffff_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):6487
                                                                                                                                                                                                                      Entropy (8bit):7.90376532755891
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                                                                                                                                                                                                      MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                                                                                                                                                                                                      SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                                                                                                                                                                                                      SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                                                                                                                                                                                                      SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\jquery-ui.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2363)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):36594
                                                                                                                                                                                                                      Entropy (8bit):5.280448617485699
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:10OW0o4b6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHCqQPH1E:U4b/+vaW1e07CBF5fyD3ErDS25Y
                                                                                                                                                                                                                      MD5:48B634CC145D6374F451520CC9638311
                                                                                                                                                                                                                      SHA1:D59AFEC5961C41885AB365E29005B02730DAD09E
                                                                                                                                                                                                                      SHA-256:4528E977EAE52058B750F9D5352D814E29A2BD8EDC1BCD329402E67E68B295C4
                                                                                                                                                                                                                      SHA-512:8CD14F776D95F145672B6E1A0CA1C44804AEB43F3F4EA72BC7AFF758B587146D5134D2D451061E57B69148224BFE11CD5AF14A5EED0A5AE9673B9C94B91CC4E9
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=30273a&bgTextureHeader=highlight_soft&bgImgOpacityHeader=25&borderColorHeader=231d2b&fcHeader=ffffff&iconColorHeader=a8a3ae&bgColorContent=3d3644&bgTextureContent=gloss_wave&bgImgOpacityContent=30&borderColorContent=7e7783&fcContent=ffffff&iconColorContent=ffffff&bgColorDefault=dcd9de&bgTextureDefault=highlight_soft&bgImgOpacityDefault=100&borderColorDefault=dcd9de&fcDefault=665874&iconColorDefault=8d78a5&bgColorHover=eae6ea&bgTextureHover=highlig

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\jquery-ui.min.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (29532)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):31350
                                                                                                                                                                                                                      Entropy (8bit):5.223859065827434
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:U4lcR8lOXHc11eveVazOm0+4l6GVEPGSc7nfZBhVk:IXHcEeVazjgl6GVEPqBhm
                                                                                                                                                                                                                      MD5:361D1D4C0FF0AEFAE3F9807DAE3572AE
                                                                                                                                                                                                                      SHA1:A2CA23A18D57C9800F0B4FD03D3169DB4FDE8DD7
                                                                                                                                                                                                                      SHA-256:7C6C400B8D286B59DA3CFC10E53A1669F340F90B4CD48515B9FF7EF8349E1FAC
                                                                                                                                                                                                                      SHA-512:7FC0D21ACCF6E3FB4776D8B37B72754FCBA43C8EF26BB4FB9748A77C0930FF62E7540814AF742F10134185682DA3FA856B16B1DAFB4F65ADFD90B469CE32C9AC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=30273a&bgTextureHeader=highlight_soft&bgImgOpacityHeader=25&borderColorHeader=231d2b&fcHeader=ffffff&iconColorHeader=a8a3ae&bgColorContent=3d3644&bgTextureContent=gloss_wave&bgImgOpacityContent=30&borderColorContent=7e7783&fcContent=ffffff&iconColorContent=ffffff&bgColorDefault=dcd9de&bgTextureDefault=highlight_soft&bgImgOpacityDefault=100&borderColorDefault=dcd9de&fcDefault=665874&iconColorDefault=8d78a5&bgColorHover=eae6ea&bgTextureHover=highlig

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\eggplant\theme.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (1395)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):17940
                                                                                                                                                                                                                      Entropy (8bit):5.086626971912176
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:XyHqQPH1LBF5fygdwWmEcQEdBs7rgmB0iBfT9RhS2wV53skuMaaSQhQz0iIh20:XyZBF5fyD3ErDS25Y
                                                                                                                                                                                                                      MD5:6D58605EFA0BE1BA65372D9CCFD510CE
                                                                                                                                                                                                                      SHA1:AAE121EC1FA89DE991FCBEA540AF8E423FEFEEF9
                                                                                                                                                                                                                      SHA-256:06247389586C2705B4DFDF601C751B04847EB3641E3878F6E97C230C121AD4DD
                                                                                                                                                                                                                      SHA-512:641E17A8E793D1902C9BB6EB6B9B04CE4986E5C025154066D3C0753DF874DF0CB11F6C06186475DAC252BC44B974DFE96CD14392F4A56414E5930BC70AAF6860
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=30273a&bgTextureHeader=highlight_soft&bgImgOpacityHeader=25&borderColorHeader=231d2b&fcHeader=ffffff&iconColorHeader=a8a3ae&bgColorContent=3d3644&bgTextureContent=gloss_wave&bgImgOpacityContent=30&borderColorContent=7e7783&fcContent=ffffff&iconColorContent=ffffff&bgColorDefault=dcd9de&bgTextureDefault=highlight_soft&bgImgOpacityDefault=100&borderColorDefault=dcd9de&fcDefault=665874&iconColorDefault=8d78a5&bgColorHover=eae6ea&bgTextureHover=highlight_soft&bgImgOpacityHover=100&borderColorHover=d1c5d8&fcHover=734d99&iconColorHover=734d99&bgColorActive=5f5964&bgText

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\images\ui-bg_diagonals-small_25_c5ddfc_40x40.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):400
                                                                                                                                                                                                                      Entropy (8bit):6.3943414419884546
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7egU9+qFCYR2oQApEsHyszS+EELEMPS:X9+qFfgoQAp/HyszjEELEMPS
                                                                                                                                                                                                                      MD5:E28D9FDC77D1CABE522D76F6A8431E2F
                                                                                                                                                                                                                      SHA1:6EBF1C38D3C4264DE61AB7BD15432E8615EB39A3
                                                                                                                                                                                                                      SHA-256:9A86ABAF12D82902252F5D18B7EE2972C9605FD507AD279E22F1F9EE53F58599
                                                                                                                                                                                                                      SHA-512:AF0930A931FDF089D67527A60364B2A088B704C72ACD9D182CFA65F841B89850B39DD7098F2DD3A0F2305AFDACF22B611921FF3257AB2099655BA7E7E71A6B5C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATh.....0.DQ.....]PL.`2f@1A%#.0..%`.......y!..K.^k......=..>).?..h...{w..).?`......0.1..1.a.c...vH....K.0.1.a.;.h~..%b....0..R4?...1../....y...M....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\images\ui-bg_diagonals-thick_20_e69700_40x40.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):475
                                                                                                                                                                                                                      Entropy (8bit):6.752318098655858
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7egU9+b04gBOdOrEBOwZRHRg8iPs4OQ+Z+yzS+EELEMPS:X9+bCBBIBfxg8x+yzjEELEMPS
                                                                                                                                                                                                                      MD5:A64F6F201FC8C651C5C88BB4035CC0EF
                                                                                                                                                                                                                      SHA1:24FDBC731401B085F7C115819C797E83B45B8945
                                                                                                                                                                                                                      SHA-256:2DC875A19C0884466AC284544BA2E1C6F8D64B0A5C070AEA8837718DC4E7239B
                                                                                                                                                                                                                      SHA-512:54BDD1A57E96F432353457778015D759311A0F5687FD088CE1F6C9A7FE25F2DBB49D4F8D013F551B55B5BF0C5F5E8DF6E24EF7909E06AC3185B49F56D7A68955
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATh.....0.F.8.tt..$..:3.g.v.b.J$.....>$.{...8.../=....>......L...q........PM0.Z.......J..m.k..j.^.K.\.8:U.&0...&Q+`...S..0...{.....D.*..G\.....H....Ku..S.`...L.V.<...R.`65..@Uc........&Q+`...S..0...{.....R.N.Nu..S.`.U}..>.........%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\images\ui-bg_diagonals-thick_22_1484e6_40x40.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):467
                                                                                                                                                                                                                      Entropy (8bit):6.551733813034693
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhP2gUyKfp5EJ4/KaMpTYOvJE+SwNrzEIs5lwKSlQdfNiCxzgN+E8VLEMlVbG:6v/7egU9+LHX9REIUSIiCxzS+EELEMPS
                                                                                                                                                                                                                      MD5:E3B17CD6A93A1119D1974390B693906E
                                                                                                                                                                                                                      SHA1:61071377D2C6B7CB7A9F1569D58BB194BDE6A8D2
                                                                                                                                                                                                                      SHA-256:70EDE93717F645F1BC66F67CAF12B885ACBE60DE378F61088AB2B607F9CB92BB
                                                                                                                                                                                                                      SHA-512:EB251150CE1DB402F7F5E75BEA8748463BFEE4FC1E2E46108691B2C4973C6FAB4E0C05DD35F11D5852572F4E07EE869AF746B6D84B3ABE320ABE16DF5452DABE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATh.....A.........(.^h....A).`. f.&.......zf....]N...95....s..9.....^.gw.Cm.....M-..T..P..C...8;....A.....0...S..0.Z.....:X.j.?.3R...y.apvj....I...Gm.....M-..T..P..C.~Zt...D.y.&.J......@u....:..E.....0.j..".....m:...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\images\ui-bg_diagonals-thick_26_2293f7_40x40.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):464
                                                                                                                                                                                                                      Entropy (8bit):6.63752038608698
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7egU9+RcLO80YNJoroGsPoGs0j2zS+EELEMPS:X9+SLu2W5sPoGsQ2zjEELEMPS
                                                                                                                                                                                                                      MD5:1E83CBEA9DB15BC529ED10025F161EFA
                                                                                                                                                                                                                      SHA1:5C10F56CC53DA52E4E781D4ADA03DF32DEBA4250
                                                                                                                                                                                                                      SHA-256:A9AC1DB351456F78CED0DBC0B1A4EF42978AA13FDA297854320E92532E185D2E
                                                                                                                                                                                                                      SHA-512:89D18E5880F26DCA7C014221993920279289D6AC4047ECFCB98D53480BF9C088D1945D0A7E2AB0AFAD9E64F6CF7A7D7033D906E95F86EFE3667670DFC8E3A6D9
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATh...!..A.D.e..,..58+..*Xn...!.i3.tf.A..T.N...\...{;9y...9.sz...>z...Y.....M...T..P..C-..pvj.C`.u.L.v.<...R.`6..+P..C5.......H-=..K...S.`.u.L.v.<...R.`6..+P..C5..u.i.C`....Q]0......X.j`...u..O.N...S.`....2....#.....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\images\ui-bg_highlight-soft_100_f9f9f9_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):325
                                                                                                                                                                                                                      Entropy (8bit):6.042377501793925
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPedUyKOkp4/nhUoI5s0GbzgN+E8VLEMlVbEbp:6v/7WdUChUT+bzS+EELEMPS
                                                                                                                                                                                                                      MD5:8B553361D5B0873A7CA47A8431F411FF
                                                                                                                                                                                                                      SHA1:AF4FF9CF0FAEF9F03F793AB10781F29A8A01707E
                                                                                                                                                                                                                      SHA-256:07CFE84A9D3C68A80CE8C878E53A092E25346F43CDE426582958F85A8210B025
                                                                                                                                                                                                                      SHA-512:95D90602B49B61C5A5D6C09D6D14DD17A241E1B275C9F619A597B6524B993272C0E5D6F2F225183BC1BF523CE49F5FFA9129610AB2656B04E9FAE1926951BEA3
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......MIDAT...1.@0.@...qyw2.K-$..3.*\.,y.x...*Y...#.E.D...'J.(3.@.%.&.dY.=.........xI..C...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\images\ui-bg_inset-hard_100_eeeeee_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):314
                                                                                                                                                                                                                      Entropy (8bit):5.943498819236378
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPedUyKOkp4/Akl27opeLDvJX4wbvzgN+E8VLEMlVbEbp:6v/7WdU62A8Dx3bvzS+EELEMPS
                                                                                                                                                                                                                      MD5:ED49819A8691DD27D0D1515C1BA3C23A
                                                                                                                                                                                                                      SHA1:F9E91232D206E59CC1132312B9B4C0040A3F39CB
                                                                                                                                                                                                                      SHA-256:5239FF76C9F2A9F6827A5D8C90632E81B67C64B2A326A38FB7A10CED6A4DAC78
                                                                                                                                                                                                                      SHA-512:3E7D5BC375E901235D05346A52B9C1A5412D6CD8659409C479C92E4FED04B4E56005FA2DCBF8BC08D3BC8C7BF69F45A3B091E0403CB4CD36BAB2AA9A2AB71A31
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......BIDAT..cx....a`..{c..g..W3|4e.$.......&..L.....31.c.!..c3.O)&...t'....|..D....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\images\ui-icons_0a82eb_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.76566668388668
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:ONbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:AHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:9FF8528D9DA88808316D02CDECADF673
                                                                                                                                                                                                                      SHA1:FA7FAF603910CF3FB79B646296F154F23BB837F3
                                                                                                                                                                                                                      SHA-256:3892107CADDFAC58F15140C2CA6FE0D95C94650D1CE16E6D69529A88B6FF14D5
                                                                                                                                                                                                                      SHA-512:5B5EA2C588000EA657C36AAE88D83FE9DFE176D01EAFC2E716D5F41577C5F7493FDD5AC517A06628C528133540F32C69D89D4E012302EDF169A7167F1B7B10ED
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................).\<...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\images\ui-icons_0b54d5_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.771562469506502
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:VNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:lHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:80120F22D98CA56E3B581A6F868407AF
                                                                                                                                                                                                                      SHA1:C892F39EF3F4663AB96E2A8532136737296F981C
                                                                                                                                                                                                                      SHA-256:A4749B3B9273C0C4309EB52353F96775F206C7CCDA35ACCF4EF06C049EC86FC0
                                                                                                                                                                                                                      SHA-512:989838792182C51C915CDAF7F99944B4EC657AE6C96F9471CDFB6DD756E2FFCF775355A59790DAC928EE671E9A7BE111ADE64005D8A61F32277ADE272D127BED
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..).U...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\images\ui-icons_5fa5e3_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.772839275823038
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:pNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:xHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:A895567FCD9642A984998239014336E1
                                                                                                                                                                                                                      SHA1:46F2F8D8A7E5BA4C43BAB76C59B31E97ECD097A7
                                                                                                                                                                                                                      SHA-256:8B0A0E3F015B5284028E49D5F648A713CD84E590A92B264E5EF2B057F9BFC480
                                                                                                                                                                                                                      SHA-512:8EAB4F177B3DCAA8FE64207BBD7CED21C8C5CC85E6A0F32DFC2AB041EC5200E2FB060E29CBCF60102DB9FB9F9B003AEF058596E0FBAE2371C4D6E559BFD82386
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE_.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._..^.l....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\images\ui-icons_fcdd4a_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.76837161257278
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:wNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:CHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:9A3D720517D8EA32ACC5AD2E4DBA0CC2
                                                                                                                                                                                                                      SHA1:B6F591E702A734C68CFD706BEF5EEF70054D7155
                                                                                                                                                                                                                      SHA-256:0025AC75218AA091A3C505338E6D11CC5FE23FCCD14D325AAE8E5382383027D7
                                                                                                                                                                                                                      SHA-512:F5EB071B5CBA7E27AA249B257CDE5E6320AECB7181ED941309FE2BE97D68B5305248A4584968201E1D318C4D6AA56E5F1B5E47A3E994C8CD96A646590073F4A0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J..J.......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\images\ui-icons_ffffff_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):6487
                                                                                                                                                                                                                      Entropy (8bit):7.90376532755891
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                                                                                                                                                                                                      MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                                                                                                                                                                                                      SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                                                                                                                                                                                                      SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                                                                                                                                                                                                      SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\jquery-ui.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2363)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):36698
                                                                                                                                                                                                                      Entropy (8bit):5.28035327558939
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:10OW0rjJZtwQb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHC6:LJDb/+vaW1e07s0eF5fyjEDDS25ST
                                                                                                                                                                                                                      MD5:F351054A1B46BD928E59B13D030E6B4F
                                                                                                                                                                                                                      SHA1:3EB7234578BAB7419832E0A3DFC86C75ABC894A4
                                                                                                                                                                                                                      SHA-256:57CB76A47FE436DE2E47EA17A92AF89654703B9EECA92319785DCC005397A8A4
                                                                                                                                                                                                                      SHA-512:2CC409B551AB6FB01C45F02C90A9F31E43C23E3C64FDAB66FFDAC4D0ED94858F0F0EC9BF5FEB5DC48424592E06F8D2C14B0F80755BC77D6A0A736744649740D8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=segoe%20ui%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=3px&bgColorHeader=f9f9f9&bgTextureHeader=highlight_soft&bgImgOpacityHeader=100&borderColorHeader=cccccc&fcHeader=e69700&iconColorHeader=5fa5e3&bgColorContent=eeeeee&bgTextureContent=inset_hard&bgImgOpacityContent=100&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=0a82eb&bgColorDefault=1484e6&bgTextureDefault=diagonals_thick&bgImgOpacityDefault=22&borderColorDefault=ffffff&fcDefault=ffffff&iconColorDefault=fcdd4a&bgColorHover=2293f7&bgTextureHover=diagonals_thick&bgImgOpaci

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\jquery-ui.min.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (29612)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):31432
                                                                                                                                                                                                                      Entropy (8bit):5.223109584340976
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:LJDlcR8lOXHc11evMbRlzkmm+4F6GpzG8Sc7nfZBhVOi:L0XHcEMbRlz1+F6GpzGcBhr
                                                                                                                                                                                                                      MD5:4702538DBCFAAADC53257EA73B3C9778
                                                                                                                                                                                                                      SHA1:FA6B5D67DE133FF4A47C8D48E216E326A199F99A
                                                                                                                                                                                                                      SHA-256:70B2BF6325B71F6134DD87CDE2982BC5087F0124E377F78F4B3891046870055A
                                                                                                                                                                                                                      SHA-512:5344D6C05D9498813DF028790E5FD179264BFA9452CA8031A142380F475879380DE8EFD272F983E261D71CD4B93733B013D95D227C03C9E0C5FCDF4EBE81D9C9
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=segoe%20ui%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=3px&bgColorHeader=f9f9f9&bgTextureHeader=highlight_soft&bgImgOpacityHeader=100&borderColorHeader=cccccc&fcHeader=e69700&iconColorHeader=5fa5e3&bgColorContent=eeeeee&bgTextureContent=inset_hard&bgImgOpacityContent=100&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=0a82eb&bgColorDefault=1484e6&bgTextureDefault=diagonals_thick&bgImgOpacityDefault=22&borderColorDefault=ffffff&fcDefault=ffffff&iconColorDefault=fcdd4a&bgColorHover=2293f7&bgTextureHover=diagonals_thick&bgImgOpaci

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\excite-bike\theme.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (1397)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):18044
                                                                                                                                                                                                                      Entropy (8bit):5.085323780214413
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:XVjJZtwZ7HnoBp51kF5fyc0aqEc2WpA1OIgmB0iBfT9RhS2wV53skuMaaSQhQz0N:XxJS0eF5fyjEDDS25ST
                                                                                                                                                                                                                      MD5:EF0D1841B2D27EE513B7F063E3BBD504
                                                                                                                                                                                                                      SHA1:22BB0182FB7C8080948EEF969F33513E17591B90
                                                                                                                                                                                                                      SHA-256:F936DFFB4243444117334CEC80EECE47DD8C38AF820AA4ABB2E43133CE69A427
                                                                                                                                                                                                                      SHA-512:3B83A89A2465452B628D807115DE1831CDB99778AF5107D94EDD73D662C287B5A193B7714FE3A3EC2B8CA23278C003CCCFE85EA5DC82B28B2D88431C8F4B686C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=segoe%20ui%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=3px&bgColorHeader=f9f9f9&bgTextureHeader=highlight_soft&bgImgOpacityHeader=100&borderColorHeader=cccccc&fcHeader=e69700&iconColorHeader=5fa5e3&bgColorContent=eeeeee&bgTextureContent=inset_hard&bgImgOpacityContent=100&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=0a82eb&bgColorDefault=1484e6&bgTextureDefault=diagonals_thick&bgImgOpacityDefault=22&borderColorDefault=ffffff&fcDefault=ffffff&iconColorDefault=fcdd4a&bgColorHover=2293f7&bgTextureHover=diagonals_thick&bgImgOpacityHover=26&borderColorHover=2293f7&fcHover=ffffff&iconColorHover=ffffff&bgColorActive=e69700&bgTextureActive=diagonals

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\images\ui-bg_glass_65_ffffff_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 1-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):265
                                                                                                                                                                                                                      Entropy (8bit):5.584405453257474
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPh3EUyKO0klyjl2XIzgN+E3VKF2EMiVAVTp:6v/7J0U0l3XIzS+E3V+2EMiVw9
                                                                                                                                                                                                                      MD5:8EF0673B1B97B64B47D4AB54BAE5793D
                                                                                                                                                                                                                      SHA1:C5C918B8003EC9D14A197DC9F9E0EB52F14E0CAE
                                                                                                                                                                                                                      SHA-256:3D59D264A71F5FEECC7A8D9E4DA1B0439FBE0C029AB6ED5F5FC4EA785212CBAB
                                                                                                                                                                                                                      SHA-512:A08439B5B19E25B6AD0298BE84BC924566354A388D0F4F75FEC63EBB87594DA00D15AF608A661B1451324B5B768E69041CCEAA29FCA829FCE2597AAB3B0C4A74
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............G#7v....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME....."........IDAT(.ch`...p....h...4.i...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\images\ui-bg_highlight-soft_100_f6f6f6_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):330
                                                                                                                                                                                                                      Entropy (8bit):6.145631819865785
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPedUyKOkjwFFRtIs7wJSOQ2zgN+E3VKF2EMiVAVTp:6v/7WdUpsRscO3zS+E3V+2EMiVw9
                                                                                                                                                                                                                      MD5:45ED73FE52DAF16B2D3A0E72662479E2
                                                                                                                                                                                                                      SHA1:76FE051E93E4508E1FD918028DE5B68900BAB964
                                                                                                                                                                                                                      SHA-256:1B789CAD6E5512F4EB6B3543BA96AABD5513DCDF944218BC59BB4E81811C4EAC
                                                                                                                                                                                                                      SHA-512:BE8236401084C0EDD5D169A208C5C686F7B8E1C24E0C750B8E590D8940DF6576262C839822E613E134608F6B79E615C341F7A25C365E6A97B1FCA7B66B0B330D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......RIDAT.....0....- ...\........p.$&.....=8.I.D.+...X.L.(.p.(.c.q..]xa.....RO..n..\..........%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\images\ui-bg_highlight-soft_25_0073ea_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):393
                                                                                                                                                                                                                      Entropy (8bit):6.466032240390623
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7WogU9+wTJ4PMnmAV3XyzS+E3V+2EMiVw9:no19+wTJ4PJAVHyzjE82EMr
                                                                                                                                                                                                                      MD5:D8B3965B9A0F738201E2ED73842D1CD0
                                                                                                                                                                                                                      SHA1:88047653F0BA0170C890D7B4BFE154D3B0D0AA37
                                                                                                                                                                                                                      SHA-256:3F5E8DC44FE61C8CF47056EB6A048CC6C33421F62323D05C41DD1CF785AD1613
                                                                                                                                                                                                                      SHA-512:6C6DB70787ED33DB38398064ED44AAE9DB86329A62D05FABBC300CE328CAE5ABE48AD57192EE84D9AFFF6BCE9EF857058156B9DE9BE4E5030C4A7F5B96366AA4
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(..1..P.CC.:{........^.].....^..]>B..E(....Uz...GBH Xm.j\......W<..k'.A...]"Q{....."5!. 't.....0.h))...>.B.g..H..".s......Y{...p.../.8.p5`.p5....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\images\ui-bg_highlight-soft_50_dddddd_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):339
                                                                                                                                                                                                                      Entropy (8bit):6.224470981713993
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPedUyKOkaWlvnnH9CILkn3Z00g2zgN+E3VKF2EMiVAVTp:6v/7WdUldCVC0g2zS+E3V+2EMiVw9
                                                                                                                                                                                                                      MD5:274D0A867B4B7383B8F00DF1ABF31C97
                                                                                                                                                                                                                      SHA1:9EECAD7F83B31AB8D6737EFED4F0EF0D02336198
                                                                                                                                                                                                                      SHA-256:A59969DE2C0EB56021CB423D2AEAE22655A2CF4B0F08E5D79FA2F207C70AC812
                                                                                                                                                                                                                      SHA-512:DCA724499AD621A631A7EB2AD2CB372D691CA5F8187321DCC356768175792519ED6BDBAFEE5722305A8FF7528D949F852ABB132EA1C4212770F56CC3317B492A
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......[IDAT....@P...'.FI.1...@F`....{X....&.,.....g*..%kE....{.....k&.X.Y...J.G..[8|,k.c.d._../......3J...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\images\ui-icons_0073ea_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.744729627550153
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:FNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:1Hm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:D41835FDF53408D566DF927F3643A838
                                                                                                                                                                                                                      SHA1:1C5AD08E530026EFEF2F3F16206C2C174ED6A0C6
                                                                                                                                                                                                                      SHA-256:55131EBC9D75A319E819963134EE159BEE69FB1BB273B66DC6ADA30BB6BA8825
                                                                                                                                                                                                                      SHA-512:C302E3D192884847D2146F628AC69E77412B35786FE8C4EB27FE307C02C4702C5E99A018D0BD7D7CDB66CEAB8056FBCACCC22B6C32FA76D4751EC86119024074
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s..s........ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\images\ui-icons_454545_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7090
                                                                                                                                                                                                                      Entropy (8bit):7.925434318681863
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:Tbhz1Ogz+PpLVLuOyc3AJzX/7N/dlbNPtGzQ4gGdBcFk3v4Ql+p23elLTJVaXKkH:NQ3tIOj6/dtFRCMmgo+p/Z9UFAhKDsHW
                                                                                                                                                                                                                      MD5:5C3BA680CC34CD9B30855C180474A152
                                                                                                                                                                                                                      SHA1:91FFCF4A399238C121F42951BA801E7C5030C1DA
                                                                                                                                                                                                                      SHA-256:33EEDA3A7ACEAC3E727FCA686F18E8736824ED4A1FCE72B8952F01EB2356CD77
                                                                                                                                                                                                                      SHA-512:4FD4B8000F8059C5CA9484A3B61EA10C1323110336D924983D3473F489A4FE7E417DB2AF4E02433BFE017831E6B80CC427C00531EACC55BFE6D2501CD2686269
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.E.;.-....tIME.....%...'E....IDATx..k.%Gu..m;....!.^...p.l.0..[..HX..H...:w...8;.........g1s.....].&..<...............C.lfq..!,."....Wu...{.v.Gwn.>U.UuN=..S..x4.g.:...........6!.Agb3.. .6+.J.D...0...&..s..N..._..B..s..&.&..>~.=...c{v..j%.._.D......Y..E...F.q...G..........R.S.C....E...!..'..NP)~..t.=;..w.me.BH{.s...S......&..S..6MCP6.z..!(..hnE.6.Vj.cO..6.y7..i.~fK.......j.T.0....<.2.......6+..^;..4.~%.....px.h8..4.^.../............:...2..n..6eL.h.`~..=u....p.....r..n.0s....Os.....Wr...G...h. ._..C..mz.-..=.)w....Fi..#...@u-c..P...O.{.S.s.^|B..A.'m.TQ.....n.`..[.......|....t.7.^..p......@........px.h8..4.^...s....C8.U..k....N..}..A. ..*..s.%......~...a.JYT}.-....1..pT..V..P%.%...?p(.>~.PA.E..........]..1.^.....(...[#....\....WR..>4j"m.h...I.@I.>]...y.........A6...........E:..q7.......n..05A...uP..y.L.8.Pj....K.9.[...E.Z............L...u.....L....;X

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\images\ui-icons_666666_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7111
                                                                                                                                                                                                                      Entropy (8bit):7.928455943008907
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:eMzXuohHXyFN1Ce1gydd84kWORcDrbeq3ek:79HXk1t1gMd8WOkrbeUek
                                                                                                                                                                                                                      MD5:D779CF92249EF61590F0B6FA32207423
                                                                                                                                                                                                                      SHA1:5D0223055783B026D13CCF508FD54317B030981E
                                                                                                                                                                                                                      SHA-256:18257A1FC35E3B8C129E2EE60DA4B617703FE80E43F8D8F3052614BF7AA8CABF
                                                                                                                                                                                                                      SHA-512:440349B6C97F034C635D731A128EA0A637867EA971631B7A0F4835EB92FD2B7F892B1AFB9CAF78681FE36EACAC8C179793159A29A2052B0F561295C359B31B36
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.f.\._....tIME.....%...'E....IDATx..{.eE}.?.H(cX.1..[R.`....J.H..E.$U....cE....Q.2;#...f.c.,Hj..cQ5...5P...qK.......$...1....%'..W.9.:..;..=...s.=..>............d.5..x..^.../.2.........mV..&.@..`..MX9......$)...=.,...0L.L...}.0~z[.....J...5..S.#.G....p_....I;,.:q! `.X% 0.\..C. ].H.....B(T..(..R....o{vX3.)...........6h.>...XhN.^.4.Ab....!CPz%..Lm0..m...m..n....m...9.c.....].=.UL.W..W7..)........6+..^;..4.~%.....px.h8..4.^.../............:...2..n..6eL.h.`~..=u.....(.#%$....4`.*.3h...5m..m.......5@.. .~5<.e..........n.oF...|..d{...U.^@...>]..L..-oz.....e..%PE..f......$\..')y8J..^k.._9&.t.;..o2.:....A.......@........px.h8..4..7..:....._+-..s.E.K%.2..5..UA...(.<..`......+P..3l..X..S..G..n%p.U".YR.[..........R...q._`....P.5`..Y.BKl.5b)....Z|.......t.Q.i.E.. Lc.J..t.S...Ch....Jgn.b..(;...Z.-..tVk.n...R71.%.5`j..i..@/...uq...4s.h.`s....... ..]&.Ua.q;].A.....

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\images\ui-icons_ff0084_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.741874689095492
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:QNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:iHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:CDA9229A0065C60B446D7F7649A66990
                                                                                                                                                                                                                      SHA1:FA668D67BE21B2B327BA98A8058ECC1F2C0FDF99
                                                                                                                                                                                                                      SHA-256:03E5843431B1363AECC079313E1596ECA5B159193151B2B185CD6940FC8F33B3
                                                                                                                                                                                                                      SHA-512:8C9DB2836B8EE3C4FB7492FEED43A66B997A9C1432264D91EAE7864921DADD297FAA78650507DD5B8473193A67A4F57C8E77D08A3E50177A29FF6FEF4C864E6C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................@......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\images\ui-icons_ffffff_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):6487
                                                                                                                                                                                                                      Entropy (8bit):7.90376532755891
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                                                                                                                                                                                                      MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                                                                                                                                                                                                      SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                                                                                                                                                                                                      SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                                                                                                                                                                                                      SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\jquery-ui.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2363)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):36444
                                                                                                                                                                                                                      Entropy (8bit):5.27355053792439
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:10OW0cuqb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHnk76wS:Iuqb/+vaW1e07kF5fyLEZDS254
                                                                                                                                                                                                                      MD5:0DFBBBD17E074941DCEF6E995E6BBE7A
                                                                                                                                                                                                                      SHA1:DC4F67554CDA422929570A1DA422FA2349D7F216
                                                                                                                                                                                                                      SHA-256:CB111613D1BC715D28CE5A7C1D2CB9AF791E4FA451AB133CD2E372DCEBA7BF7A
                                                                                                                                                                                                                      SHA-512:8F9A2414E8AECF514F93A5352C41520312D4ED602D131FE60348C382026328BCD7653C46C2D7B274B5789053F0928C3A214170AE4E87A0C6B560002F18E01F48
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=2px&bgColorHeader=dddddd&bgTextureHeader=highlight_soft&bgImgOpacityHeader=50&borderColorHeader=dddddd&fcHeader=444444&iconColorHeader=0073ea&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=dddddd&fcContent=444444&iconColorContent=ff0084&bgColorDefault=f6f6f6&bgTextureDefault=highlight_soft&bgImgOpacityDefault=100&borderColorDefault=dddddd&fcDefault=0073ea&iconColorDefault=666666&bgColorHover=0073ea&bgTextureHover=highlight_soft&bgImgOpacityHover=25

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\jquery-ui.min.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (29381)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):31161
                                                                                                                                                                                                                      Entropy (8bit):5.215426726449217
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:IuqlcR8lOXHc11evzjzkmQ+4q6GpEqQSc7nfZBhVM:zFXHcEzjz1Eq6GpEqwBhG
                                                                                                                                                                                                                      MD5:AC03FA666A7B451F80ED0CC13FAD2A61
                                                                                                                                                                                                                      SHA1:6776165B37FBE486AA5DF65FC4DA6C0DC5263A83
                                                                                                                                                                                                                      SHA-256:FA7C7C248D092B5859A3EBCF34BB4ACC5B673E5C9B0D0D38C6FC9DA86F2D5105
                                                                                                                                                                                                                      SHA-512:631ECBDC098EDB237BA88335B8CD0CAB1EA5777E52663EE8C86FE067AEBC40DBC1CC9B2FA1079B845A6C975CC461547A8ED602A5770299EC02BA1BC7AE30E1A2
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=2px&bgColorHeader=dddddd&bgTextureHeader=highlight_soft&bgImgOpacityHeader=50&borderColorHeader=dddddd&fcHeader=444444&iconColorHeader=0073ea&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=dddddd&fcContent=444444&iconColorContent=ff0084&bgColorDefault=f6f6f6&bgTextureDefault=highlight_soft&bgImgOpacityDefault=100&borderColorDefault=dddddd&fcDefault=0073ea&iconColorDefault=666666&bgColorHover=0073ea&bgTextureHover=highlight_soft&bgImgOpacityHover=25

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\flick\theme.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (1357)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):17790
                                                                                                                                                                                                                      Entropy (8bit):5.06910679770385
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:XOuik76wF5fyQCEcktpBVqYgmB0iBfT9RhS2wV53skuMaaSQhQz0iIhWZDjb0:XOu3F5fyLEZDS254
                                                                                                                                                                                                                      MD5:2DF72AFC330A1550D9F5873B5C1B9E94
                                                                                                                                                                                                                      SHA1:8E1503CCDF9C9D0C2B3D2C377F68AC0EAEF506A7
                                                                                                                                                                                                                      SHA-256:6483A696BA691E280265BDA3B149780615B74F6E92168ECA7491A9391EEBF254
                                                                                                                                                                                                                      SHA-512:DE9929B3298EF51CD5149AF8702DD2714CC18CF23482A1BE8D20F1B4FB7CDF4D520BDBD3194C30984686CC32037C3C854CE895D7B9F528144295395828E3B426
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=2px&bgColorHeader=dddddd&bgTextureHeader=highlight_soft&bgImgOpacityHeader=50&borderColorHeader=dddddd&fcHeader=444444&iconColorHeader=0073ea&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=dddddd&fcContent=444444&iconColorContent=ff0084&bgColorDefault=f6f6f6&bgTextureDefault=highlight_soft&bgImgOpacityDefault=100&borderColorDefault=dddddd&fcDefault=0073ea&iconColorDefault=666666&bgColorHover=0073ea&bgTextureHover=highlight_soft&bgImgOpacityHover=25&borderColorHover=0073ea&fcHover=ffffff&iconColorHover=ffffff&bgColorActive=ffffff&bgTextureActive=glass&bgImgOpacityA

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-bg_diagonals-small_40_db4865_40x40.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):390
                                                                                                                                                                                                                      Entropy (8bit):6.412660102227287
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7egU9+g6m4MbPANBEsHalgzS+EELEMPS:X9+g6m4MboNB/HalgzjEELEMPS
                                                                                                                                                                                                                      MD5:4E0C10D138AC4D6E1F5FBF2C3F12C6F0
                                                                                                                                                                                                                      SHA1:8CDF55C9A9A30B671CE782E68FC3747AD3362158
                                                                                                                                                                                                                      SHA-256:7B576CBF72A47E77132D59D5B955ABEB5471796D27A3E83E6613C8164740FAF0
                                                                                                                                                                                                                      SHA-512:30D1ED9641CDD3E88FBF7700931DFEC6DC77BE928D98A13EF0635A6DE7B4427111A7075DB8B4850C41CDFA7A16327648590AA559239B01ADEC13EF1DC627EE40
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATh.....@.DQXEB..E#.k...U...A.=..L..9.7g.R.4l9.g_.+.........>).?|R4...`.....c./....0.1..1.a.c...vH....K.0.1.a.;.h~..%b....0..R4..+._c..Y....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-bg_diagonals-small_50_93c3cd_40x40.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):391
                                                                                                                                                                                                                      Entropy (8bit):6.370731262783017
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhP2gUyKfp5EJ4/al/Sdssq/7Swff+Dr+1Zx8uv7/axzgN+E8VLEMlVbEbp:6v/7egU9+HlKdstOPiFxKzS+EELEMPS
                                                                                                                                                                                                                      MD5:1B1CC1CB76DF40329A52A4BD9CC75EA6
                                                                                                                                                                                                                      SHA1:330262B70015FABBB8DA025214432A0AEF07A9F7
                                                                                                                                                                                                                      SHA-256:8EFAFBBCD3D8B327FF15D57967185B635676B417A1BEA6CF9861FFA07D734B50
                                                                                                                                                                                                                      SHA-512:C0CAE010535E73B04EDE6F7B7F386FD40CFDB1BBDF99A650B4433B468EA95E97A78C2464A5FEF477E70004443147F7B03381CB321D618AFE54F4699CCEAE6FCE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATh.....@..Q..X.`..dA.Y.e.5!X.....g..p.I^_J..u.M.8.._....NJ.....?8)9.pR4.a...5.K..5.a..Rr~...5.a.kX..._.D.kX...0!%..0/Q....5LH.....`A.1.^...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-bg_diagonals-small_50_ff3853_40x40.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):388
                                                                                                                                                                                                                      Entropy (8bit):6.354872721575915
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7egU9+GZyyxlpD+jEcd5F3QKzS+EELEMPS:X9+svp0vPbzjEELEMPS
                                                                                                                                                                                                                      MD5:10AC5210150D17551470BC939DA04A60
                                                                                                                                                                                                                      SHA1:BA2E3737ECAEA469D9F85EEC6F14C69690D87037
                                                                                                                                                                                                                      SHA-256:A93394C7BEC90E6F898F8F1F9D33BB1725F3AD1907DFA6224CDCA7F254414BF5
                                                                                                                                                                                                                      SHA-512:F60D6979A7C6455058B7D4DFA2E01FED81A2285E10624501382858810AD1E250849DED139B5E8189C22450A00CA4BEC1ACDFBFF3454F52BF503FE9C45701F2C7
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATh.....0.D..j...GfR$..p..t<,;.?..y......me...u....'E....{..h..I..+;.....1.a.c...vH....K.0.1.a.;.hv..%b....0..R4;...1.a.c...)....Y@.J.a....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-bg_diagonals-small_75_ccd232_40x40.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):391
                                                                                                                                                                                                                      Entropy (8bit):6.349775460966113
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhP2gUyKfp5EJ4/ah/0jGUq5vJ2r+1Zx8Q8lIzgN+E8VLEMlVbEbp:6v/7egU9+Hhcw2iFDzS+EELEMPS
                                                                                                                                                                                                                      MD5:720A6733061E091A739F0E3FF957DE8C
                                                                                                                                                                                                                      SHA1:8E0E34E79B5479713B0081350EFE98B1F0F1E545
                                                                                                                                                                                                                      SHA-256:05E59552BCBFF8E1E263B554683A04BCC0CE0C9A0E1AF4A10CBA37554EC1A314
                                                                                                                                                                                                                      SHA-512:6381A5F6B483B0445BFB2E9D40B424B0FAF596BA8A89793DECEF3BD741DECB5CE23299D1C19BF3A3B712145E2309F86944009DE1003F6AAEB79FE29A0DFBE11C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATh...1..@..Q.; A.....0D...N....--...[M.Jk..:.6.c,.y\.....NJ.....?8)9..0.Q....5LH..5.K..5.a..Rr~...5.a.kX..._.D.kX...0!%..0/Q....?..U........%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-bg_dots-medium_80_ffff38_4x4.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 4 x 4, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):283
                                                                                                                                                                                                                      Entropy (8bit):5.665634854822703
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhP7TCUyKfp5EJ4/idkRRb2zgN+E8VLEMlVbEbp:6v/7SU9+5C6zS+EELEMPS
                                                                                                                                                                                                                      MD5:7D8B6B72638427A0E1C392E20CB32D66
                                                                                                                                                                                                                      SHA1:387DFE019CCFDB830337C0D7050BB8A5F0F41E1C
                                                                                                                                                                                                                      SHA-256:6165C234EFBE5BF7BD1FE9A81565617C9D7645004BBC4BD8C12E18A58270E531
                                                                                                                                                                                                                      SHA-512:D6F5A58FF14B21F1149D41A5339CAC1C80A3D0F81719B283F06340189D5E8AAC19EBCF346D1DFBB9642BF1CF7E1A9E62C8C667D9E0937EF854048ED6A4A4C5DD
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............v..j....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDAT..c...........`.X"H..T...(.R....,?...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-bg_dots-small_35_35414f_2x2.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 2 x 2, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):281
                                                                                                                                                                                                                      Entropy (8bit):5.646173013782732
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhP2+UyKfp5EJ4/36uLZrIzgN+E8VLEMlVbEbp:6v/7ZU9+cRIzS+EELEMPS
                                                                                                                                                                                                                      MD5:8E8F8AEE6EACB637989B7219DE450E22
                                                                                                                                                                                                                      SHA1:F8C70020AC19E9C72028AF3AE1A89DC6733EE7CF
                                                                                                                                                                                                                      SHA-256:1652C711D94344091329CD44FD113CFCF64EDE343139425614400CB81199C991
                                                                                                                                                                                                                      SHA-512:4A89FEC42E9D191E22DB5681B6B8308DA280B20C09807F60068BE36BF06CAA956F45AD34CAD48CC67A3656EC3F453EB37D58B61A7D79CE6A19BEB99C6133232A
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............DF0....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDAT..c45ut..g``````.P......(.. .L.....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-bg_white-lines_85_f7f7ba_40x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 40 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):422
                                                                                                                                                                                                                      Entropy (8bit):6.134023606491844
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPSaCUyKfp5EJ4/alZgmRsZL+wO2zgN+E8VLEMlVbEbp:6v/76aCU9+imM9zS+EELEMPS
                                                                                                                                                                                                                      MD5:A487D190889A22604DD005EFCBB35C76
                                                                                                                                                                                                                      SHA1:4795B34872158DFA003B6BB9401F2726BDBA0C78
                                                                                                                                                                                                                      SHA-256:DD76479A304E49E86F3EEFCEBD619BC73F1CDC8C12D0327C6F44F3BD3E8E28B7
                                                                                                                                                                                                                      SHA-512:9AED42B04D2B663F01C3AA9EE462A2ECF3E69A79DED157A9261D97D4084CB895E46606B22CEED3A93EEB17D5EE18DAFBFEA23641094670251B43FDCEDD83B69F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...(...d.....+.9n....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATx...1..0..AJ*..##^.....<w.~...Z....u...<.y._g.gX:..u...t...,]g.:K.Y...u...t...,]g.:K.Y...u...t...,]g.:K.Y...u...t...,]g.:K.Y...u...t...,]g.:K.Y...u...t...,]g.:K..n..]..!...=...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-icons_454545_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7090
                                                                                                                                                                                                                      Entropy (8bit):7.925434318681863
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:Tbhz1Ogz+PpLVLuOyc3AJzX/7N/dlbNPtGzQ4gGdBcFk3v4Ql+p23elLTJVaXKkH:NQ3tIOj6/dtFRCMmgo+p/Z9UFAhKDsHW
                                                                                                                                                                                                                      MD5:5C3BA680CC34CD9B30855C180474A152
                                                                                                                                                                                                                      SHA1:91FFCF4A399238C121F42951BA801E7C5030C1DA
                                                                                                                                                                                                                      SHA-256:33EEDA3A7ACEAC3E727FCA686F18E8736824ED4A1FCE72B8952F01EB2356CD77
                                                                                                                                                                                                                      SHA-512:4FD4B8000F8059C5CA9484A3B61EA10C1323110336D924983D3473F489A4FE7E417DB2AF4E02433BFE017831E6B80CC427C00531EACC55BFE6D2501CD2686269
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.E.;.-....tIME.....%...'E....IDATx..k.%Gu..m;....!.^...p.l.0..[..HX..H...:w...8;.........g1s.....].&..<...............C.lfq..!,."....Wu...{.v.Gwn.>U.UuN=..S..x4.g.:...........6!.Agb3.. .6+.J.D...0...&..s..N..._..B..s..&.&..>~.=...c{v..j%.._.D......Y..E...F.q...G..........R.S.C....E...!..'..NP)~..t.=;..w.me.BH{.s...S......&..S..6MCP6.z..!(..hnE.6.Vj.cO..6.y7..i.~fK.......j.T.0....<.2.......6+..^;..4.~%.....px.h8..4.^.../............:...2..n..6eL.h.`~..=u....p.....r..n.0s....Os.....Wr...G...h. ._..C..mz.-..=.)w....Fi..#...@u-c..P...O.{.S.s.^|B..A.'m.TQ.....n.`..[.......|....t.7.^..p......@........px.h8..4.^...s....C8.U..k....N..}..A. ..*..s.%......~...a.JYT}.-....1..pT..V..P%.%...?p(.>~.PA.E..........]..1.^.....(...[#....\....WR..>4j"m.h...I.@I.>]...y.........A6...........E:..q7.......n..05A...uP..y.L.8.Pj....K.9.[...E.Z............L...u.....L....;X

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-icons_88a206_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.7631740339012625
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:MNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:WHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:6F8361C3E4351B84BF3449B2701CE861
                                                                                                                                                                                                                      SHA1:EF8C4855A849C16CEA1650017A6404E70BAC3181
                                                                                                                                                                                                                      SHA-256:907AADF33361459CCEA40A206C98931326960C582B5CC11C2CE810B479942145
                                                                                                                                                                                                                      SHA-512:8D0124F13FB863733C33839B3D4F56237ED2714F15E18889305E05F8D8032760C092C5D2D6DEF9312A8B99AF4EEC157A64934F130AD59DC3B5E6FC377CC0E432
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................Y......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-icons_c02669_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.772342562166625
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:P6NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:8Hm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:FE57FF3C330F2C99D0ECA3B4A62193D4
                                                                                                                                                                                                                      SHA1:5C8737BF0BD8604E8147B08748961E88D16E3A9B
                                                                                                                                                                                                                      SHA-256:303BCAF3594BCFEFDB6AC4AE0515E861D5F49DF2C0C2FA8B347C405AC1A2E270
                                                                                                                                                                                                                      SHA-512:AB06288B03703973591848CA0CBD17EBF2C03A222C4F7365EA329870DCA90731C5DF30C21E7D741EE8D62FC1C4B6DB4C5C3FF91E5F0E0E7BBB73BA5D75446914
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.&i.?.7...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-icons_e1e463_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.771406934410624
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:dNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:NHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:ED955934AE5EA87AB2F0957D40FA4267
                                                                                                                                                                                                                      SHA1:2DC74F149F07A61B25EACA2F56652278896CAE30
                                                                                                                                                                                                                      SHA-256:3EA861761D71742E401F877935F3BB1A18E69F2687019CDC7CC8C2C64427D80F
                                                                                                                                                                                                                      SHA-512:A25FEC163A11C11AE732C2BD1D0FFC5A5D01669FF29C74826B05AE211D64A1EABB5514B69A2F518748CBFC93C3AE5D1D3FDECB730955313A89C6573CC8BE25A9
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c@#.....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-icons_ffeb33_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.765983658404223
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:5NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:hHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:9D00A6D4BA4F79E2BCEE3E63231D34E5
                                                                                                                                                                                                                      SHA1:E33289D398EE9D09397CC524818AEB7F591446CE
                                                                                                                                                                                                                      SHA-256:05B3A820CA3017660904F14267F7A4D63BD6836AE1CD976655C5075C08BC5976
                                                                                                                                                                                                                      SHA-512:A6671EC92532446B5930534539891A4B54D1A61CCDF8160C98F2480B1D2499FC33EE13133E100590D3B923C96CF74E2AB5D22B710A92727F2AFF0F630A426D34
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3.......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\images\ui-icons_ffffff_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):6487
                                                                                                                                                                                                                      Entropy (8bit):7.90376532755891
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                                                                                                                                                                                                      MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                                                                                                                                                                                                      SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                                                                                                                                                                                                      SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                                                                                                                                                                                                      SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\jquery-ui.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2363)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):36678
                                                                                                                                                                                                                      Entropy (8bit):5.286597440644566
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:10OW0DJHdb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHif/YA:J9b/+vaW1e07xF5fyNEfDS25k
                                                                                                                                                                                                                      MD5:36397A5A1B350CC70097C4E07929FA35
                                                                                                                                                                                                                      SHA1:E847C13C022A0CC51A709EE629582764FEC47DA0
                                                                                                                                                                                                                      SHA-256:64B283D576CFE63228E63E652B10A4A3A3738E132981FEF6491E155BFBFA5D96
                                                                                                                                                                                                                      SHA-512:84DFFA8865349E7B0DBC3237CBF17FE2EE8522993ED7C12DDAC39F7896987DFBF5B23BB6197E5E29EBDB4C426772820059E2AEA8EB6C39D53CD642290B44652D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Gill%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.2em&cornerRadius=4px&bgColorHeader=35414f&bgTextureHeader=dots_small&bgImgOpacityHeader=35&borderColorHeader=2c4359&fcHeader=e1e463&iconColorHeader=e1e463&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=2c4359&iconColorContent=c02669&bgColorDefault=93c3cd&bgTextureDefault=diagonals_small&bgImgOpacityDefault=50&borderColorDefault=93c3cd&fcDefault=333333&iconColorDefault=ffffff&bgColorHover=ccd232&bgTextureHover=diagonals_small&bgImgOpacityHover=75&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\jquery-ui.min.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (29631)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):31446
                                                                                                                                                                                                                      Entropy (8bit):5.231060034048568
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:J9lcR8lOXHc11evFVz5m6+406GYznPSc7nfZBhV1:yXHcEFVzUa06GYznBBhn
                                                                                                                                                                                                                      MD5:1B832A993E798FC7FFC284180638122C
                                                                                                                                                                                                                      SHA1:058805999875DF95CEAE1950FDA6BBEE951383F5
                                                                                                                                                                                                                      SHA-256:08C88929232369FC82BFA1AC22701C7D8A085926D420506AF825CAD7F180155D
                                                                                                                                                                                                                      SHA-512:5D23EEF553B5340812841673EB59053CB83EAD062D9768F98A044B62B616E9A6085680DDBEE3EDB3CE4E91E73C2112C1CDCE70640BFBC0C89410DAB184C31874
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Gill%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.2em&cornerRadius=4px&bgColorHeader=35414f&bgTextureHeader=dots_small&bgImgOpacityHeader=35&borderColorHeader=2c4359&fcHeader=e1e463&iconColorHeader=e1e463&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=2c4359&iconColorContent=c02669&bgColorDefault=93c3cd&bgTextureDefault=diagonals_small&bgImgOpacityDefault=50&borderColorDefault=93c3cd&fcDefault=333333&iconColorDefault=ffffff&bgColorHover=ccd232&bgTextureHover=diagonals_small&bgImgOpacityHover=75&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\hot-sneaks\theme.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (1392)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):18024
                                                                                                                                                                                                                      Entropy (8bit):5.097226917357615
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:XhJHef/YL+EF5fy3W/EtEc2tyAArYgmB0iBfT9RhS2wV53skuMaaSQhQz0iIhp7:XbtF5fyNEfDS25k
                                                                                                                                                                                                                      MD5:F7093D52EFCAD4980108022C708E38E6
                                                                                                                                                                                                                      SHA1:63639060CF664EF5D32652EBE81026EFA09F7C2B
                                                                                                                                                                                                                      SHA-256:957FFCC659BD342D3D119D217B71D3870E2BB3EEF1F0427EA361CC9A882EFC8C
                                                                                                                                                                                                                      SHA-512:DAE35BE29C8F5F87B416307ED7A506A9CD9A23DEE4BC3992FD078DEF8675208B220FCB9E3A5AA436242D265F589357A36C12E0B18F879BDFEB142B75C67F9C83
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Gill%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.2em&cornerRadius=4px&bgColorHeader=35414f&bgTextureHeader=dots_small&bgImgOpacityHeader=35&borderColorHeader=2c4359&fcHeader=e1e463&iconColorHeader=e1e463&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=2c4359&iconColorContent=c02669&bgColorDefault=93c3cd&bgTextureDefault=diagonals_small&bgImgOpacityDefault=50&borderColorDefault=93c3cd&fcDefault=333333&iconColorDefault=ffffff&bgColorHover=ccd232&bgTextureHover=diagonals_small&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=db4865&bgTextureActive=diagonals_small&bgIm

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-bg_glass_100_f5f0e5_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):412
                                                                                                                                                                                                                      Entropy (8bit):6.496577555859627
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7J1r+U9+eeOG85ePv5yvzS+EELEMPS:krr9+8GweEvzjEELEMPS
                                                                                                                                                                                                                      MD5:69BF34EF32FD7F228D36E9A129D7FF66
                                                                                                                                                                                                                      SHA1:3C5010F8A57A1F64A75571891A4A9396BFC98991
                                                                                                                                                                                                                      SHA-256:14C4D36F86216BED8AB46E05948440540C6C46471EE05820334CA09D07295390
                                                                                                                                                                                                                      SHA-512:98DDFA6DBE190479041BB39E2C7480F99D35FF42CA9BD09FBDEA47A74963A9134CE44892A96D500D9F42C498122A0B5ABC2A2F91618F7E7CE67CB4F11D36C9D8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATH...1..A....MAh......AHD....)......I..t.GP........S...........a...60F.(.me.k_`..I.9.TA...6Eq....n.Z......+..m?b...UW..4.;u3}B..j....D...,..h...i.a....k.@..it....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-bg_glass_25_cb842e_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):393
                                                                                                                                                                                                                      Entropy (8bit):6.5155240134751295
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7J1r+U9+J14hJAjIF2lr2zS+EELEMPS:krr9+J14o062zjEELEMPS
                                                                                                                                                                                                                      MD5:5D7674A2015FB83A6E8F71FCCDC77787
                                                                                                                                                                                                                      SHA1:F540B9B656AA397EC44C528533C8D2DC86C38657
                                                                                                                                                                                                                      SHA-256:43D59E2F8DF1DBCB758D5A15F0E41326939BDB34E5BCD343C91CBF90EBF8FA28
                                                                                                                                                                                                                      SHA-512:0D013077587A14CF075CB4C1B46ACE965C64D9A86AB0AEC2F93D6D3E24C119E7037E6C68F144E701DCAFF5512E611E3CF38B3A40C32FEB4B73575E69AC9E1FB7
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATH...!..@......V.....&.A....h..55.N.%.&.j,..)....~.Y|....p..q....:<G....%{a..1.. .J.B.e.......aR.[%;.{.l-DU.b.R.........H;.......!'.s.T...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-bg_glass_70_ede4d4_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):409
                                                                                                                                                                                                                      Entropy (8bit):6.553771963328409
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPh1r+UyKfp5EJ4/XzgB7HolAClIo5syYdKUDSKzgN+E8VLEMlVbEbp:6v/7J1r+U9+9NHolnB5ESKzS+EELEMPS
                                                                                                                                                                                                                      MD5:1338B2F36305DF419F9D02073EE82260
                                                                                                                                                                                                                      SHA1:38C3AF97436D91927ED81441940E81987493C876
                                                                                                                                                                                                                      SHA-256:445572C0E2730CD024D4B4677EABDF8FADF90BD220E6FC9BBBB391DA3E2F4B1E
                                                                                                                                                                                                                      SHA-512:058DEB7E62A00524EF3AB8EF327E0E45BB4192782E0FCEC3DCFCC4246C85C931635FC95A016FD201DD98710D06A909B2D9FD511D35657109278EFD993F996ECB
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATH...........FR..b.R^.zO......~....d.(.A.`Q..KwGw.b..b.O.....6>....0...:.{>HCD...w.!.......f...=>5Er.....dQsq.....1......[......M.D6J..A(.......0~..n.3'j.W....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-bg_highlight-hard_100_f4f0ec_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):385
                                                                                                                                                                                                                      Entropy (8bit):6.445561092623
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPeogUyKfp5EJ4/3MtXKUh9EuCOm4UwEZY2zgN+E8VLEMlVbEbp:6v/7WogU9+LbvEuCOmdvzS+EELEMPS
                                                                                                                                                                                                                      MD5:EFCC4A901D32B64E9234EE8331069665
                                                                                                                                                                                                                      SHA1:B6652C311B7935EDB6955DE30C6A8A9198C599F3
                                                                                                                                                                                                                      SHA-256:AE37955D964E1F3CD40B6F48287CE5F26C08C3995877017D93A2E34CABDDC427
                                                                                                                                                                                                                      SHA-512:368F9FC5DA1D715B55CF77E97D60E0B78F398BC21513E1359622D9D597712ECD011BA3F3018AA4A2DA0BEBB455A099356957251F370C169BEEEF488CDF53012E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDAT(...!..@....o..(<.O.'!...._.%X.G....Opm....!.hB....;..X....D.S.M.=.$.......6..g....r9c...i.L..n.....>...T].}.UcBh.....O...k>L. .a...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-bg_highlight-hard_65_fee4bd_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):372
                                                                                                                                                                                                                      Entropy (8bit):6.343100446698306
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPeogUyKfp5EJ4/6UbEn19st28A04nqJ8qlRVgiFcSuf+vzgN+E8VLEMlVbG:6v/7WogU9+RLn3sXADn6lRVgoxQ+vzSr
                                                                                                                                                                                                                      MD5:C2DDEA1F78686FF032149F477DE9DF46
                                                                                                                                                                                                                      SHA1:71EA6516F3C1F906F19D9820C47678A73FFD70E1
                                                                                                                                                                                                                      SHA-256:ADA10D93CD8D332A65CB059BBDDD09DA62A8D534CC7A5F59CCFD49B630B2AFBA
                                                                                                                                                                                                                      SHA-512:DC35F8B48D06A4EC8764FD80FDF4759B625D06BD7D89964B2A3B133EEF95294C72B47D4B14EAE829F7B5441F79A03575BAC8C8A3046BCC81399037E80CEA61A6
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x......xIDAT(.....A.D.QW.XP.p-@B.G..h...*h....s......MHP.xc.o... ....x..*.].Dv.H^.,FO......&.btSO"..{...L./c%...r......!.B.:.P|v]...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-bg_highlight-hard_75_f5f5b5_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):381
                                                                                                                                                                                                                      Entropy (8bit):6.3424039844238544
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPeogUyKfp5EJ4/0DvsNj3jwZcUqa/dTv1c9dR6Oi6zgN+E8VLEMlVbEbp:6v/7WogU9+aNTjszqYL1S99zS+EELEM6
                                                                                                                                                                                                                      MD5:586F9F3503FCB7F946CD446094936AB9
                                                                                                                                                                                                                      SHA1:03B3DAA94DAFC7FF7AF1EBAFF98E9FF5467EB34C
                                                                                                                                                                                                                      SHA-256:DA1919C9B136E3AD109E49415A731B2A4129C78B4AC3ADE387E60BB279644625
                                                                                                                                                                                                                      SHA-512:6DF64AF4A0C1CE4BAFEB30AD6DE699C44E62BC219559543FA07644E82647419F69D9E8DCE507FFC6A23D39C05ED201C996D7A1099E4CAACAB38C329A19C326DF
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDAT(.....`.F..;.]..xY.7".::..8.X.-.Ckx...|.._Css.M.v..K~O...>a._....10..y..Z..&....Y..1.RKO.y.E|..*f...1..],EO....|..w...)^..;...#[...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-bg_inset-soft_100_f4f0ec_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):461
                                                                                                                                                                                                                      Entropy (8bit):6.769093155244375
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7WogU9+w8Elrm+vRBB5E7jL2zS+EELEMPS:no19+glrNfE/qzjEELEMPS
                                                                                                                                                                                                                      MD5:65A7EE8510678A4E6F1B6E4556FA91DD
                                                                                                                                                                                                                      SHA1:020587178A4C3F8A02D23DE838F0BD44C56D7C18
                                                                                                                                                                                                                      SHA-256:F85CD2797BD6CB66C2BAC16DDD8209BFD06688DF884DA7A389FBEE3669613DE5
                                                                                                                                                                                                                      SHA-512:AFBB0527F0539543548D9ED84CA735328FBCF8532C637FE4ACA357963B82CA643FCD6498FC302BB21493A407E10FD37558F06CE04149591A21EF67D28FFE7A99
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDAT(...K.Q....=t"...h.....%E..Y....l.....`..Xdm.".I4..,......{.w.f..0........4U....`.g......G...a.}.L..e}9}G"...!.E;{Et1..p.f5.+.......-.S../...Pt.5....\......Zt#.P....C5(.y...%.........s...(..+.i..._...{[..';J...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-icons_c47a23_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.765571973013318
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:6NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:0Hm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:258CC1658196388E44F44CE2CA342839
                                                                                                                                                                                                                      SHA1:CFF5E5A39B568471E5265A1B90FA4C26582CE371
                                                                                                                                                                                                                      SHA-256:8A50E81928F2FF1CFB83CEE554E368412965A658A02074C4D75FE6EFE2938095
                                                                                                                                                                                                                      SHA-512:D3059387D0ACF67B549BE4AD5D1E78A7FD7F88164FAD7A51A4B1A1FB0E4C2134699DEB5C0B4838BEFB433E6B4FD4EC75255FE7625D3527FFA1F5D5DB35A24988
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.z#.a%2...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-icons_cb672b_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.774920146248026
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:mVNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:mlHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:6854089D6E540ED92F49B4697790DEEF
                                                                                                                                                                                                                      SHA1:03D9D6114763DD07E81209520BFC815466C83E48
                                                                                                                                                                                                                      SHA-256:C01309AF5216C7C917D49C3570720640D663B8ADED6A8A7A0DE0A25EFB0269F3
                                                                                                                                                                                                                      SHA-512:30CF018338DA4BADC610B4184D2A086CF186C6318732839485CF6629C3D76FA886A23CD431D33F187A194B85E0797568746B7027E2CA83EA114B94777811EE82
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.g+.(T~...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-icons_f08000_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.737504834420342
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:2VNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:sHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:C042A8B4780C14B1C866FAE17E9D68D7
                                                                                                                                                                                                                      SHA1:084FC7A1BB68B972680A6F4D28F6C257D94CC270
                                                                                                                                                                                                                      SHA-256:55FC63139CE52570A1FBEA3CBD2013D44D40978B76817EDC7BE50985F09FB31E
                                                                                                                                                                                                                      SHA-512:249EF041AC3D9A21AE44F47C64D467E3147B44151D32C59F833C83A34308C474DEADC7F6E1D9D062A13BB29F4B22B08863CD776051F12E3609227FABA5322A4A
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................r3.....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-icons_f35f07_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.772920110125113
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:eNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:wHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:5BE468BBE60C121128DD56D098304C70
                                                                                                                                                                                                                      SHA1:1D7F99B89E9B9BBA19DE431ADD2A4E09FF12E61A
                                                                                                                                                                                                                      SHA-256:FEB9D17256C1DA0668B0BA4294129FC70CE41F93280D047D3DAF36FE68F18EF0
                                                                                                                                                                                                                      SHA-512:58FC62D4E6DDB5CDDBA6C83A2F767E24E11F868C614EDB2DC6966A4FD5783B356EF6E3508DFA3C04DC0A0BAFC63B459B9793366046C83DC22A73EC5D09721B71
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._.._....P...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-icons_ff7519_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.76872546534799
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:MsNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:XHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:90D4B95F7F5018E66653FF33D32F35A6
                                                                                                                                                                                                                      SHA1:0AEA94585C167FB945886AE060AF265690E11AA3
                                                                                                                                                                                                                      SHA-256:5E8091D9C902F959F52E76DB516B55E2AAAC0050073A1815AA3A2DF53EA7E9CD
                                                                                                                                                                                                                      SHA-512:68A8B2C2430E1AEFEE986C32B2C877A843E2AE9E94DA6A591860917C4316E35DEEE733EC69EB0368910EA5B4FD298234634EAF84EC9947A71AB3495E6FD3363E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u....z...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\images\ui-icons_ffffff_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):6487
                                                                                                                                                                                                                      Entropy (8bit):7.90376532755891
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                                                                                                                                                                                                      MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                                                                                                                                                                                                      SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                                                                                                                                                                                                      SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                                                                                                                                                                                                      SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\jquery-ui.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2363)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):36663
                                                                                                                                                                                                                      Entropy (8bit):5.280742395188275
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:10OW0z6inb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHDPGgQ:P6inb/+vaW1e07fxF5fyfEnDS25elak
                                                                                                                                                                                                                      MD5:674D8DEC33C5F767656EA4CA9D3B1E49
                                                                                                                                                                                                                      SHA1:25467C7287E18CC3F9B25E7C6A4062F0BEF8418C
                                                                                                                                                                                                                      SHA-256:9C01DCB690FD699B47F9A5789B94C6C262BDE16F9CE2897344F7D0BB13731F2F
                                                                                                                                                                                                                      SHA-512:E72BEE17EFA750C379FD467B6F4428E06DA78DEC467D3CDC3B484F86D3157826F5F705FDA5A45B119905C04D9FA533F27E120C3C0F7A065515CDEC16D32E1EB4
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=cb842e&bgTextureHeader=glass&bgImgOpacityHeader=25&borderColorHeader=d49768&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=f4f0ec&bgTextureContent=inset_soft&bgImgOpacityContent=100&borderColorContent=e0cfc2&fcContent=1e1b1d&iconColorContent=c47a23&bgColorDefault=ede4d4&bgTextureDefault=glass&bgImgOpacityDefault=70&borderColorDefault=cdc3b7&fcDefault=3f3731&iconColorDefault=f08000&bgColorHover=f5f0e5&bgTextureHover=glass&bgImgOpacityHover=100&borderColorHover=

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\jquery-ui.min.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (29655)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):31449
                                                                                                                                                                                                                      Entropy (8bit):5.225591069957868
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:P6inlcR8lOXHc11evZezYmo+4a6Gb+UoSc7nfZBhVpWGc:CiOXHcEZezJsa6Gb+U4BhI
                                                                                                                                                                                                                      MD5:A5716D950139D94F9E7242DB8B4E761F
                                                                                                                                                                                                                      SHA1:45A232921F3E540FC44E6CCBC60FEB3825227013
                                                                                                                                                                                                                      SHA-256:CB99219FC9221A319DFD8D39EC0842D5669AD23F20EBA2781C9110DE9CB5BF8A
                                                                                                                                                                                                                      SHA-512:3BE5DB0802811EA6AA0D5503DF0C2826D555EA4400E038E41F6267B15A213BB053B47D8AA38AEB67BCEAF0CA8478683B1EFE0C55910EB3B005DE23F3B0BCB1B0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=cb842e&bgTextureHeader=glass&bgImgOpacityHeader=25&borderColorHeader=d49768&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=f4f0ec&bgTextureContent=inset_soft&bgImgOpacityContent=100&borderColorContent=e0cfc2&fcContent=1e1b1d&iconColorContent=c47a23&bgColorDefault=ede4d4&bgTextureDefault=glass&bgImgOpacityDefault=70&borderColorDefault=cdc3b7&fcDefault=3f3731&iconColorDefault=f08000&bgColorHover=f5f0e5&bgTextureHover=glass&bgImgOpacityHover=100&borderColorHover=

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\humanity\theme.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (1371)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):18009
                                                                                                                                                                                                                      Entropy (8bit):5.086710250031702
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:XV6ilPGgBT7pF5fydQKHxrEck1n7HcugmB0iBfT9RhS2wV53skuMaaSQhQz0iIhJ:XV6iVxF5fyfEnDS25elak
                                                                                                                                                                                                                      MD5:23894B7DE810C64646B893B2ACDCD2AE
                                                                                                                                                                                                                      SHA1:5F5D705E8DAFB123FFCC66170E7E950D74D22439
                                                                                                                                                                                                                      SHA-256:0EA261BF9D84D24960C2FA03342951BB2277D1AF7979D09F76F6DECA83D58A65
                                                                                                                                                                                                                      SHA-512:955BE102E9616D6C9DE3F7DDDBE19AE3C229DFF63F86711C87B5D8C1A3D1329EDE106522B8B17CEB745821EEFB3539205B4B0C0D3ADC49EC1090EA25C36F1F56
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=cb842e&bgTextureHeader=glass&bgImgOpacityHeader=25&borderColorHeader=d49768&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=f4f0ec&bgTextureContent=inset_soft&bgImgOpacityContent=100&borderColorContent=e0cfc2&fcContent=1e1b1d&iconColorContent=c47a23&bgColorDefault=ede4d4&bgTextureDefault=glass&bgImgOpacityDefault=70&borderColorDefault=cdc3b7&fcDefault=3f3731&iconColorDefault=f08000&bgColorHover=f5f0e5&bgTextureHover=glass&bgImgOpacityHover=100&borderColorHover=f5ad66&fcHover=a46313&iconColorHover=f08000&bgColorActive=f4f0ec&bgTextureActive=highlight_hard&bgImgOpacityActive=100

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-bg_diagonals-small_0_aaaaaa_40x40.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 40 x 40, 2-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):265
                                                                                                                                                                                                                      Entropy (8bit):5.540970259068032
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPCCXUyKOCll429uzgN+E3VKF2EMiVAVTp:6v/7KCUj9uzS+E3V+2EMiVw9
                                                                                                                                                                                                                      MD5:CF7E81416128126610509E22CBD9999E
                                                                                                                                                                                                                      SHA1:1B2CCB53763564EEB7B554591E144AB1A423A4A6
                                                                                                                                                                                                                      SHA-256:918E530A373F786E040E2AB16A45430DC6203B412B93300C7C3FA657DFC1001C
                                                                                                                                                                                                                      SHA-512:16B515F1A48FBF362034AE29F78774E55AC2119267AB6E8D270A98110F7AA4A4134D6616D07C7D4D8AF62115B1A1D91F43D32B21D682EEDC839B8094D78032E5
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...(...(......%......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..3.r.....tIME....."........IDAT..cX........T.....J....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-bg_diagonals-thick_15_444444_40x40.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 40 x 40, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):383
                                                                                                                                                                                                                      Entropy (8bit):6.464989287779997
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhP0CUyKOkuhGpY/EfbSO6iZvxxMrzgN+E3VKF2EMiVAVTp:6v/7MCU4GpiEjSiZpxMrzS+E3V+2EMiw
                                                                                                                                                                                                                      MD5:A0C61FF561D4CB1E68B4D9877848AB0E
                                                                                                                                                                                                                      SHA1:F2927DD772F61EE4C58B47030F4BD52F73C1B8F8
                                                                                                                                                                                                                      SHA-256:573A4C7CAC703E66D4B3C08B4FB9332C4477E9DFB6350D048084C429295AAE69
                                                                                                                                                                                                                      SHA-512:3B3E9747871C3230C755C1C0DB42997AD37FA5A79DA81B6F10BDD9BC6D8E9C24B78D14246EBA331613234F66817ECD3B6EEA78F59016D76E73BB4218037501B3
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...(...(.......;.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."........IDATH...1..0...g........DO.R.."B..!o......8.R....I...n....q.......u..p........Hp..p7Hq..8.XN2..|l.....dC.0..@...E......os.)?......)..:...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-bg_diagonals-thick_95_ffdc2e_40x40.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):469
                                                                                                                                                                                                                      Entropy (8bit):6.686740128366266
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7egU9+MMU/UvwitI4Y4CWYYKkslTYYKxMzS+E3V+2EMiVw9:X9+bQU4UmX/k8oxMzjE82EMr
                                                                                                                                                                                                                      MD5:301317202CED65E4879EFA5D9A95F62F
                                                                                                                                                                                                                      SHA1:C061EFAFA478E9F724635FB74C2D65851FD0FEB2
                                                                                                                                                                                                                      SHA-256:21DDACBA4BA0C9F48819307D3F2765E11DA34CFF8C002E85E2865119BD08E765
                                                                                                                                                                                                                      SHA-512:7BF8D5762185D04B6ADA6EA5E5FE16889D0BA19DC67CE55129A49CA7332E5F1FC90C21B552E1080E41F144EB7DA368EC910E740FD05B7284B8D4CBD5C561A2E2
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDATh.....0..a.....'.d.L.:.&{x.`..Jq.B(.NE....9._......:..y{|&u......G..Z.3.Y0....T...ql...d.X.J..l.*W#.@m.s.U0.Z.3.Y0.......B.`/T........J......j#.C..i...I.....J...M.Nm.s.U0.Z.3.Y0.......B.`/.i..`.T..@.|.&.G_..>^...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-bg_glass_55_fbf5d0_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):394
                                                                                                                                                                                                                      Entropy (8bit):6.499591053088131
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7J1r+U9+rxpJ7Hp7D53zS+E3V+2EMiVw9:krr9+ND7J7D53zjE82EMr
                                                                                                                                                                                                                      MD5:EC110959652282C6FE3E62C6FD4CC154
                                                                                                                                                                                                                      SHA1:56FC65EA1486D038F30962D02608140099740DDE
                                                                                                                                                                                                                      SHA-256:3C3E23F38BDC19B76BC8DBFDE2953CFE8F099699F6EF2DD1A1B05D4BB3DD92C3
                                                                                                                                                                                                                      SHA-512:8F7E5B7DB77D5FA4D63DF58B5234ECB06F88FB762ED56DC15181AB6461692EE518E1971F1650A0BD7CE0C1FA68D34E90510E1CFB8ADC28EDC67946DE87FE5E2A
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDATH...-.........&gc~.!...&E........y....c....A..N....W.\....q.oC.5MQ....c+BR....b....s...-.\$.t.....l..D.d.."...3.6...V.....1 ....8...... .W..h...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-bg_highlight-hard_30_285c00_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):382
                                                                                                                                                                                                                      Entropy (8bit):6.46202797803152
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPeogUyKfp5E/UzyTtCaqTcAqfB2KzgN+E3VKF2EMiVAVTp:6v/7WogU9+/nzqTcAqfwKzS+E3V+2EMr
                                                                                                                                                                                                                      MD5:DE474B9583FAEAFB12C9E27B8873B8D0
                                                                                                                                                                                                                      SHA1:D64D63A0AD8155C89D74300EE71EBCE6A25751C8
                                                                                                                                                                                                                      SHA-256:AA670F547114F5CD5465E89B7C4A57DDDC8362FCC301E013D6A0DB4162BCCE3F
                                                                                                                                                                                                                      SHA-512:09E01F82E65920722E640F8D1A6D0A945A4A8C3874B9DF8FCE33DDCD6981A6FCA99BB7F16A785B51F1F1D0E8B543D405BAD53969B7307A1CDF58E56563DBAAF8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(.....p....y.... ..[Y....h.hq.4..E.....`..\.`.+,}....mp..s...M|!.v..8.%.T.....|.....z.&.<..X.....'&......H..B..c...x.'....E.7.#...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-bg_highlight-soft_33_3a8104_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):403
                                                                                                                                                                                                                      Entropy (8bit):6.531002278304678
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7WogU9+nuAcOfqhilRQWGRxzS+E3V+2EMiVw9:no19+nuAcOfc9RxzjE82EMr
                                                                                                                                                                                                                      MD5:A5D6759D66ECDE0B728C18BFEAF51EC2
                                                                                                                                                                                                                      SHA1:8FDA4B6D3E9274856AD0AD0F9E5EE11EA5796E66
                                                                                                                                                                                                                      SHA-256:99E137811F7EAA484BBE02BAF6FF66FB27C19F4097287287D3F7494B761991D3
                                                                                                                                                                                                                      SHA-512:4EF13AFC3C07D782B9369E2E6E538D5800BB1A5D6BA009C04C6D17A9B1CF68C03C454D0819412BD2CE70C14761E5F2765DCA2BE5FA0C5F298925AB2F3CC50877
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(..1..Q.E_n.Lc%T_c%.".5L.Q.=Hf(|.e(...~%y.*d..HT'.6'.6_l7..33..........A'.5.^.R].`.Gh....j<.Y.#.Y{..j......e;.Ak.CA..<....G..^...|h.=ll+.}.......kE.......%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-bg_highlight-soft_50_4eb305_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):409
                                                                                                                                                                                                                      Entropy (8bit):6.613438939057223
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7WogU9+gnuOgMs+hvT2zS+E3V+2EMiVw9:no19+gnudMs+xqzjE82EMr
                                                                                                                                                                                                                      MD5:C6494494A0005BB61DF5E2917692B256
                                                                                                                                                                                                                      SHA1:6486952CDF9455DF0AA090AC02A7AB9B9CC46E6A
                                                                                                                                                                                                                      SHA-256:29F2F668B93749532BF3C747A16CC839860859407388613454F30F7C15B0CF7E
                                                                                                                                                                                                                      SHA-512:EC2EE8A71DBDC96A281D18A2E4C4D2BA6E8A0B6A0D016A06C773B2E2DFCC680B4CCA5FA7D129EFC72CF103ECB939234771AA1B0263B5576F5A965E1482D24E09
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(..1..@.D?SY(.m...&^ ......7..Fk=...-..r...E..`...a....zh[......r......p...Hm...B...Q{...<.gT..,$.+9&..2J...CK..A..'.-60..=Y...3&.[....GY....q..~./."i..C3...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-bg_highlight-soft_60_4ca20b_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):417
                                                                                                                                                                                                                      Entropy (8bit):6.622137642581435
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7WogU9+JlHsWxUdlQ3zS+E3V+2EMiVw9:no19+Ji2IlizjE82EMr
                                                                                                                                                                                                                      MD5:7D6D3976BEEA0358ED75B21FDA5D0422
                                                                                                                                                                                                                      SHA1:7E04E9D3626E201749C6532A7BB00858D6B06017
                                                                                                                                                                                                                      SHA-256:4B2CB320917A627DF5FF7746170F0C68F975C81A53644A64C1E1BC0386B21E14
                                                                                                                                                                                                                      SHA-512:A30B675E713155A282B8557EB08999029CBC45C9EBD3520181FC9F8B5650E23C04D1C17B91B7E73EC02999B1D827284C2BF8398503B2E692B4185DC9FCAB1E07
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(..-..@.._F Z.A..@!.KB....].n.........@r.*....~.%..$./..d. wW/ADD.78..v.N...E)..E- ..y.....Y.=$.,.K.....u...].....K...Iz.-C(.5.C.....E).Z......R...mm..~.o..i.u..S...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-bg_inset-soft_10_285c00_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):424
                                                                                                                                                                                                                      Entropy (8bit):6.705633807193599
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7WogU9+uxuIiknY8pw1eYORFtZ2zS+E3V+2EMiVw9:no19+uxu9IRdnXtIzjE82EMr
                                                                                                                                                                                                                      MD5:9FDE0C11BDC11666126B7AD3E6999B9F
                                                                                                                                                                                                                      SHA1:6250B784AB095051BC0C846ECC5B0147E9712DAB
                                                                                                                                                                                                                      SHA-256:08F914E7F28C78428BA850B5B404E5475849F8FC3F6811CD8C4B9EF5751B9AFA
                                                                                                                                                                                                                      SHA-512:76C31F8C6C21B2A27CE79EBF5D498120E6555278F7EA93AF6AD774B4CB44D788691BFC42E4F18A5AF9558EFFADAB1C3AE254295914226FDAF95BCB8901D1E48F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(...!...........Z,......u...T.A.m.P.#...u....`.z...V-../}.h6.S0.?...e`..Y..g....;SL...u>)..#..)U..q$Pf..'....8F.....fJ.*7..J.*......+PV.....L.F..uz.[..:5..~...o'...zn...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-icons_4eb305_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.778798081854367
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:EjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjT:LHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:7090419BC38A3AB8127077FEBED202D2
                                                                                                                                                                                                                      SHA1:0D939387645972A3FA4787F9C4345A2E6BABA60E
                                                                                                                                                                                                                      SHA-256:0CF6652148C57B54E8D8A925ADD5F37FB72DBB9E6FB3B43442CBCB1F25ED6044
                                                                                                                                                                                                                      SHA-512:83C8EC99DDC8C528067F0CF3384C54914D502594CF71315D5F027A756370652A42E6F326DF0B0773689884CA3E744A9AA97B36DD8F6C8B6E7C64B2A5EF3252CE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEN..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..| .....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-icons_72b42d_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.769506029578022
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:+NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:QHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:3D61A0B492B7EC8E2BAE60A94F503449
                                                                                                                                                                                                                      SHA1:63D2E84ACC2D0BB2BFAED6D954940F87A21B1E2D
                                                                                                                                                                                                                      SHA-256:2C114911DC4BEFA3421BADCA73BEE144AF8F0EF3B31B350013828D57D2D32F4A
                                                                                                                                                                                                                      SHA-512:28647907CC079F97019BEDF598E7543C01585D0E58EB8CEE7D756A2A493E922AC973913A992ADE3922DC92888517DD0B97127E7283276A0348384B43E3CB8EE0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEr.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-r.-...b...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-icons_cd0a0a_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.739814671431308
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:ONbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:AHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:A6A39C47239FCDBBE6E1D5BFAA7ADAC3
                                                                                                                                                                                                                      SHA1:E01C6ED29C81AD21B84D0B96427976474D77F21C
                                                                                                                                                                                                                      SHA-256:90044CC699BA3148B8F8777CF7BA69CDB63187582370AE49E3412E00056E05CB
                                                                                                                                                                                                                      SHA-512:48F691B2480F302B2064417FEEF9E28ADB28367FF2CAA549F351DD014F63A75D70AED68B546851371BEC822D7CB037CC644C6AAC1D5C2BC3B6C94E07F00CB87D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..............................................................................................................................................................................................................................................................................................................J....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\images\ui-icons_ffffff_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):6487
                                                                                                                                                                                                                      Entropy (8bit):7.90376532755891
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                                                                                                                                                                                                      MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                                                                                                                                                                                                      SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                                                                                                                                                                                                      SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                                                                                                                                                                                                      SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\jquery-ui.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2363)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):36838
                                                                                                                                                                                                                      Entropy (8bit):5.2845268342781635
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:10OW0Rmb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHwPwJiqy:Nmb/+vaW1e075F5fyEli6EDDS25f/
                                                                                                                                                                                                                      MD5:D20F5D81D352E13A899D5873A103885F
                                                                                                                                                                                                                      SHA1:F5F7655204CFA0371C00D15CE6AAAE705F35F00E
                                                                                                                                                                                                                      SHA-256:F9957EC60C4F331637AD78C1B05E4103A10D7E3D7DD8B7DBCCA0198B7D3FA1AC
                                                                                                                                                                                                                      SHA-512:9DC47C1C7E54B7AD52244429D65A3EDCB0AA0C11BB7AC27899776FBD5B9593B4E322B32F4083FB21BB8CA7392AC290A3BD2B7B0C4411F7AEFEF9A0184CA6AF0B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=10px&bgColorHeader=3a8104&bgTextureHeader=highlight_soft&bgImgOpacityHeader=33&borderColorHeader=3f7506&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=285c00&bgTextureContent=inset_soft&bgImgOpacityContent=10&borderColorContent=72b42d&fcContent=ffffff&iconColorContent=72b42d&bgColorDefault=4ca20b&bgTextureDefault=highlight_soft&bgImgOpacityDefault=60&borderColorDefault=45930b&fcDefault=ffffff&iconColorDefault=ffffff&bgColorHover=4eb305&bgTextureHover=highl

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\jquery-ui.min.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (29741)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):31593
                                                                                                                                                                                                                      Entropy (8bit):5.22868903333992
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:NmlcR8lOXHc11evNozkmn+4H6GpzdlSc7nfZBhVp0:rXHcENoz1zH6GpzdDBhM
                                                                                                                                                                                                                      MD5:6FD17EC5CC2A8EAAD538F84F9EEBF7B7
                                                                                                                                                                                                                      SHA1:1997FD0342613241A1CCD1FD7343128392FC5FFB
                                                                                                                                                                                                                      SHA-256:8512F873BC5FB880C3937C47DB16B839EB74408A77DB37C3D4E0A57E5FCFF664
                                                                                                                                                                                                                      SHA-512:EAFD40FFC636A6B82A33F8BCA43C50B75251ADF494C8831201B488DA3D79658A5222DFAB5117BE6096D912A00B94A7C86004F68D88AD8B186D679253845E6DFE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=10px&bgColorHeader=3a8104&bgTextureHeader=highlight_soft&bgImgOpacityHeader=33&borderColorHeader=3f7506&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=285c00&bgTextureContent=inset_soft&bgImgOpacityContent=10&borderColorContent=72b42d&fcContent=ffffff&iconColorContent=72b42d&bgColorDefault=4ca20b&bgTextureDefault=highlight_soft&bgImgOpacityDefault=60&borderColorDefault=45930b&fcDefault=ffffff&iconColorDefault=ffffff&bgColorHover=4eb305&bgTextureHover=highl

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\le-frog\theme.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (1429)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):18184
                                                                                                                                                                                                                      Entropy (8bit):5.095147589965305
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:XXfPwJiqn/F5fyHoEc7li6Ecf1pAyNYgmB0iBfT9RhS2wV53skuMaaSQhQz0iIhM:XXyF5fyEli6EDDS25f/
                                                                                                                                                                                                                      MD5:09E7BB15E9BE70C1B54840B55A4C6000
                                                                                                                                                                                                                      SHA1:84D8BFAC5B5A6CAB84014ECBA9AAC663DF256446
                                                                                                                                                                                                                      SHA-256:5850627DD750D41AA653DAFFB190B61085BF3DEBC944256BD4CD49B6EC729279
                                                                                                                                                                                                                      SHA-512:0A268A8A5163814B9C9E5BAE5D9CBEEB79B467A467F6E324BAF51F654295CFA8F6F2DE7CBD1CCE77A792A16F09457781A85719C574F79142A32396B5DC80EC68
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=10px&bgColorHeader=3a8104&bgTextureHeader=highlight_soft&bgImgOpacityHeader=33&borderColorHeader=3f7506&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=285c00&bgTextureContent=inset_soft&bgImgOpacityContent=10&borderColorContent=72b42d&fcContent=ffffff&iconColorContent=72b42d&bgColorDefault=4ca20b&bgTextureDefault=highlight_soft&bgImgOpacityDefault=60&borderColorDefault=45930b&fcDefault=ffffff&iconColorDefault=ffffff&bgColorHover=4eb305&bgTextureHover=highlight_soft&bgImgOpacityHover=50&borderColorHover=8bd83b&fcHover=ffffff&iconColorHover=ffffff&bgColorActive=285c00&bgTex

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-bg_glass_15_5f391b_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):393
                                                                                                                                                                                                                      Entropy (8bit):6.508024514807776
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7J1r+U9+znd9Laf+pdT56W7Br2zS+EELEMPS:krr9+zbuf+pdN6gUzjEELEMPS
                                                                                                                                                                                                                      MD5:34F6ABF331A51AF91C7323BA6391CEEB
                                                                                                                                                                                                                      SHA1:D13053BA8DAEB3E18F71F54B7DC0AFCC9678D80D
                                                                                                                                                                                                                      SHA-256:C40803C74B76AF9E74BC1DDAA9BEB1AB7104865EF7BD1052270385A01D3A1734
                                                                                                                                                                                                                      SHA-512:F39F1CF6D785D5659800EDAF9099E3796A4D8860C9477EE6A05F091F1CD61E1F19F2D0EE70BD0CDB175616A3BD46EBB768AAA160D3D74475443EA85548D136FA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATH...!..a...7..,&..v.Z5h.d0.....-F.`.+x...F...T......K..a`.f..$).. .:..}...6..[....q.....&AAM........#.k..b.3..>c...#..?N.A.........][J...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-bg_gloss-wave_20_1c160d_500x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5851
                                                                                                                                                                                                                      Entropy (8bit):7.6946038920456905
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:fHkz7tzQ5Wx+dqQw+OTN80eCadVnm23KCanUUTJSqgk5iEatVIQoz+4FQ:P4tz9odJwh53ZyN37DNfk5iEA6z+4FQ
                                                                                                                                                                                                                      MD5:861A9CB5CE63EAED1C371AAFCE1C7409
                                                                                                                                                                                                                      SHA1:68392BA0330C55346192FF876F308314E3CC5A3E
                                                                                                                                                                                                                      SHA-256:3D1985675857F2BBABE7D681C5CDAE2A7074435D96E6295A0D5863F12E752F91
                                                                                                                                                                                                                      SHA-512:69DA4D565FED81E3B9EA9F5F383481DFF036074DAC37D602C2998E4CE5AF5683EF62FC38FB89DE4C578A25F27F4D0F293700B8A37213951B19F5B19023C89FBE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATx..O.e.U........Effb..{fP..6V`C0.B.`I.N"GN..@..9.8N...b6cX .;.e..A...Yr..Hx....D.A$&.`....e.:..3.SU..w.....:u..[..{.............1.U;........;......`......0.......L.6.........;......`......0.......L.6.........;......`......0.......L.6.........;......`......0.......L.6........Z.....v.qD?.kc.^c.>....:m..P._.F..e.yu.-.d....^.....Z.3.W......M...fS=e..k9w.[.z_.7.!.2J.V^=k..(y.!..^..7..kb..5z.U..ZSf_.......R..x..#...f.7N.ja......0..[e..n.s..:...5{....M9..]....k[...W.....qrQo..Y...;.u..k...>.l..l..._.y...V..5*W....v..W?R3C..n].3Uv.......B.'^......n...m ........<.uc........Nx........`......0..a/...6..3{.G.,[.{.[....vlr..G....i....].YWR....2..C..T..R'..^j...p3h.,+..9b...-S5..G..J7.*r.5P....*.]Y{.N.z#*...Z._....ul...8Y.R....r.UY^..y[...j2[.cNI%.I..k.........f8.<...p9wd.s.[.}.~...}D.f..B.E.......6....[...s

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-bg_gloss-wave_25_453326_500x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5910
                                                                                                                                                                                                                      Entropy (8bit):7.684608225622468
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:fH75LcyckRWaCXCdsD4nMoAAzge7VBdPF/gN2avx49q371JizscvHFpKbK:P1cyckRW5XCO4Mozo2UQqpJuzPFeK
                                                                                                                                                                                                                      MD5:723B73CFFAF084B588D04A934E55F1D4
                                                                                                                                                                                                                      SHA1:27021E05AE990916B9E8750AFE9BA3F478B9DDCD
                                                                                                                                                                                                                      SHA-256:2AC203B05A8B8942CEC8F277E538F77244F432106C4B6B47F1777F4EE9D82D9D
                                                                                                                                                                                                                      SHA-512:7A325550CF751531A2BFBBB6C62BBC16DF18F482A005D6650E4DC97371D70EE582467B7664BA2F44C74B4D3F25E5F8D1764DF048108B3D6F9494ABC99A06736C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATx..O.]GV......@Jd!....q.V.=..!pB...6Q.c.....x.H..3.HHx.AL..;h......O$X...g....;..2...p..k....*.NU...o.<.[u..9U...w.......x..........Y.......pw........l......V.6......+..w........;.............`.`.........q.....X.........l......V.6......+..w........;.............`.`.........q.....X..q..=.s.#..X...%...c.bQ...<T..7z.bV...J.o.o..J/}^..Z.3k.W......M...fS9y..j9v.Z.z_.5.!.2J.VV=K..(y..!..V..7..kb..%z.U..Z.g_.(m..+WU..d....G......>.Jf......0.....t.n{..S..'1k.Q....7.H....>N.....Z.QZ.s4N....7k..Z....k.a..).S.f^..F/..%...uu.[.b5\...N...GJfh...z..V%...Q.jn....r.p...O.. ........,..^..;.................l......V....g...<p&.H.E.n.n..X...4.Q.#..<.bZ..L...+..HG.G.].!.m_..R'..VJ...p3h.,+..9....j.=..U..nJU.)k.R-..........k.(...k.~..zZ.!...d.J.......Wyy.FgmY..+.l^.1%.\.z....o~.........(.....C....m.......l..".yl...q..Ht.....

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-bg_gloss-wave_30_44372c_500x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5972
                                                                                                                                                                                                                      Entropy (8bit):7.698212690009269
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:fHsT+egenQUpb/nSSzb9W62p3VrrZrKmZTmiXJ5Rhqxwdju16tAQZgKzrayOFGg:PU+eBnQUhSkaprrKETJDRkkuBFqIGg
                                                                                                                                                                                                                      MD5:7D2C0D67EB9BCF602B3F7512CBEFC48F
                                                                                                                                                                                                                      SHA1:25E1FD526BFA0B8705AFC714509BF134F700B122
                                                                                                                                                                                                                      SHA-256:AC21BFA995A4F3C39DDEE38115D21C3BB66CE057ED3FDD70268445DEA9C9790F
                                                                                                                                                                                                                      SHA-512:44DAB62CB87F6191F839726A6DCF64F4E4F011BBE8C729965A1823C60815A7BA2BA7502CD2D482F769D40E5610E755E5B2C9E5DB216FEB858AC36CC35ADDEA37
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x......XIDATx..O.'.U.{~.N....N..B...D..xgw.F.....^.%;.....K.#...n..A.XP.!..H$'..'rd...Q"$.8!$...\...-...gk...UU...?..=[]...{U.S..5...O..Y........].......pkxp.....X.xp.....X.xp.....X.xp.....X.xp.....X.xp.....X.xp.....X.xp.....X.xp.....X.xp.....X.xp.....X.xp.....X.xp.....X.xp.....X.xp.....X.xp.....X.n..>.{a..-z{..={.e.=e!.u.'.b?O.......`[(.7.%.+..ua..g....YE1%F=.J..r.V..r......o,S.}e.r..z...}.Q...C...xko.%..r.J..p.&...m..<V...K....#..<..._..72C........9*3..a..@]OR..Y....7.%...y_L.m..^e..v....r.......Y....*.S.f^..f/Y.%....uu..R5\.m.n~......t......U...Fd....<.Z...?...?]A&.......Y8.....v......,x..........;......0...^.m..3ag|ah...=..=.vR}b;...Y....<.RZ...g.u.Tr.....2..C..X..R'..^J...t+h.,+..5b....S5.G.[K7.*R.=P......]^...z#...^......}l...b..%.klA..J.Wyy.F..Y.,W...SJ*.8a.o}...ca3l.....~.M..$>.:.?f..lA......G..<5...=.M*

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-bg_highlight-soft_20_201913_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):433
                                                                                                                                                                                                                      Entropy (8bit):6.628713451990196
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7WogU9+cDz1FZE2zqyr2avzS+EELEMPS:no19+cP5znvzjEELEMPS
                                                                                                                                                                                                                      MD5:990000B89E984CF1855C16FB555A20E7
                                                                                                                                                                                                                      SHA1:589223D8D62039EFF98959DCB400DBFA3F8C6E35
                                                                                                                                                                                                                      SHA-256:0FF5041D63B8CBA449F5BC98C2821C5909220006D1C5B69F7E0F3AF6200AC309
                                                                                                                                                                                                                      SHA-512:BC267087DA14BDC31C057BE5F354291415334849290DD2917C1AD9230570011320D958D6A87611B397F377FFB2E3CACF8D67367BC422FE11D77699B1C682EE0D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDAT(.....`.... .CE......4....dc.s......a..vm'..;`32....[ 1=.;..........7... th...4i..\y.Yt.J.3.J.3.B'.m..+...on.y..F..FkVO.".Lm\.D..TO..#*.;.^.~.n..$..R.mZ4^.,.q......o...<.<.Y.g".....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-bg_highlight-soft_20_619226_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):401
                                                                                                                                                                                                                      Entropy (8bit):6.461550350745626
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPeogUyKfp5EJ4/fIiRW7JBNsr4BMkGWkq/lkCzOzgN+E8VLEMlVbEbp:6v/7WogU9+k0PNsZuCCzOzS+EELEMPS
                                                                                                                                                                                                                      MD5:AB79BC5BE3BC772DC46252B64FA824D1
                                                                                                                                                                                                                      SHA1:567C105D0754702CA33ABD453B8EFC21A45B9D53
                                                                                                                                                                                                                      SHA-256:9F503974690E4F4D59D9813C37C3B299225712742898004D29DF20FB73AE561F
                                                                                                                                                                                                                      SHA-512:65DCAB4C036D93DC47F62181938F143ECC3489FC62A82F422E67B3AD63AB43FF2B585CB20DB1A143A947B0EF7B14793697EA45D1FE717C6B64C85879B9FE7CBD
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDAT(....P....IE..E-...H..U.+.. ...h6h..,..x.....$./....4.....%I...t..TSXCj..QRq3..&gBk....d........h2=-...):..en=.d.........c....%;..F.-.......W...O...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-bg_inset-soft_10_201913_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):438
                                                                                                                                                                                                                      Entropy (8bit):6.6438218171907995
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7WogU9+dynbgqGK3/RdPBp/7ayzS+EELEMPS:no19+AnJG0JBz7zjEELEMPS
                                                                                                                                                                                                                      MD5:479B880D56FFDE90B540CD1A04A756E8
                                                                                                                                                                                                                      SHA1:F1532AC398311E8084B8EBD88DC39D8741E493B9
                                                                                                                                                                                                                      SHA-256:EDBECA747559B65BE63840BBBD28D3D08052FBF30138F5D9E68DF5AE53651C5E
                                                                                                                                                                                                                      SHA-512:D3012A1896963953DAB12AFE05A8F48B8498B27A7FFC3D6F63E06AB03E64FD072EB2F83022FCFD5F722AFAD868C15048AB86F638D1679BDF2C022E02DAD8FA11
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDAT(.....`...s~...V...3....4..Dbv.VWa"R.^...J>.. &..,.........or...1.lV......t.}.0..[A..wc%..p.%#./.{.!.1d$T..Q.n....p.*&...Z..p'T...k.iK..s........n.Y.N.#......ej#g.o\..-A..._..]../}.W.....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-icons_222222_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7025
                                                                                                                                                                                                                      Entropy (8bit):7.929805003010536
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:IcH5ZfLGSAsNh7vB1PP0M6hPmBmc8aWkRwP4:xHjLV9b7vbaxNcbdKg
                                                                                                                                                                                                                      MD5:23ACA9C182696DB96FF9EE5BF9601461
                                                                                                                                                                                                                      SHA1:F2FB72129DB2BA61E5E9E572B24D82FB93ACC3F4
                                                                                                                                                                                                                      SHA-256:28D8B65FD4815EBFFB752BEB60B976D22E8BD4004194B8CFDD0E9A14E39814BD
                                                                                                                                                                                                                      SHA-512:F36FE89779D9EEDD2456826125166428824ABD33C999B187F69F976F51A5FAE7A2B286B44C4312B7B920BDBE0F043EBB652723962267489EB0B575EB5179FEC0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD."..b.....tIME.....%...'E...TIDATx..m.%Uy...$.!,h. ,.%..&...@.|I..E.M.r...D.....2;.f.....A^$5...j^.K.@U.....-.wW...D`..|.q..".t>........3}.S...~.9}.<.>..<.yNp..M.)....`...px..h...t%....y.Y...D.^.`..O..r.%`.:.$%...{.....0L.L..?..a|..6.....]A......7P..'@/:.]5JH.&.ay.......2....:.8t..y.....@.....#*'..?..t.;.Yw.m..........{.>|Dg7..\J.{.4..K.......3...t.f.Z...`.7.u7..Y.~f].<.....4m.*..<.%%...{.^.`....FR........l8<...O........h8<...O..........k.2..n..6cL...`>.]=u........$....,`.&.+h..k.6..J_*|.K.0...?@..lx..do..m.]..L.3...0.;......T.E,;...4......t...MO...mP.L..U.A&......e...+..`...8u...].5.7.7.~"....h8<...O........h8<.....]..C8.Y..s....Z..}i.A. ...).s.W...!.m.........z.[.#...R.....\R..{...v..........r.....R.. .?.#..[.|.f....`.........y...).A...-..Q.N..4w....:Kr{.......3...Z.P.!0t.{l.\.Y..wSn.P.IA..Vm..-.R...$y.....sI....@;..e.X...v......Y.v...B....n]g.......W..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-icons_9bcc60_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.767895128988182
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:2NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:IHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:0285460263EDD66D2D4101BDEC175D58
                                                                                                                                                                                                                      SHA1:1801FB66888A8D3434C1DC3E68C5C0A2B2474E74
                                                                                                                                                                                                                      SHA-256:B4D97785B31A6143AF7DDEB2D8C4B07ED0953F14CE21D6A2DE42EE17DF9BC49A
                                                                                                                                                                                                                      SHA-512:FF1CA551559AED3B3B9CC56CD3990FDDBB8108BC1D14D4815A0C9D7827E7AF949CAC0EB3BC9CFDF8D9F828D6DC36939DCF5B056AF6CFB9704B8359E93D61CCF5
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`..`ocq....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-icons_add978_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.780780761491566
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:5NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:hHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:FDB7A923A84D2AE91457941A8716162B
                                                                                                                                                                                                                      SHA1:3963DCE734F1B6488518EF65BDE848A9530E5B71
                                                                                                                                                                                                                      SHA-256:A1AE8A59E432E0DFE23FA3A89C79A623FD915ADECC6EACED365E3A07A36FD72D
                                                                                                                                                                                                                      SHA-512:3381E62F79697E7DB3DE45C21A5DD1EA50B066630BFCFD955DAFE2FE57538D23BA2692E01BC615E0B0704FA60F913EA909AE04B2077E4A217E28A89870E1B4F6
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x.Y.....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-icons_e3ddc9_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.775828967093814
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:4NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:KHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:C4DB516F01FE004D3FAD7BF6E17425CA
                                                                                                                                                                                                                      SHA1:46642C9DF69A8BF7C1E0F715C2FFD8967AC6AEF4
                                                                                                                                                                                                                      SHA-256:0CE7A500EE361A1EC37075FE73F5E2DF0B6A11DBFA1F7D22D28C43FCFEC7A467
                                                                                                                                                                                                                      SHA-512:F51A97EB5146E9297E24EE26C2F565EAD50AA0A066F48BD1F498DBA79112A7C6E08FEE75917ACE908007394E56CAEE8FE83829354A9AF9A1CE80F234C911E75B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................t.....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-icons_f1fd86_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.767179218098146
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:yNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:MHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:C0BDD404E4D2A5D3C93201085ADFD0B2
                                                                                                                                                                                                                      SHA1:1FC7A4CAFD0C65C1F734AAC20FAD5F41BF92C961
                                                                                                                                                                                                                      SHA-256:C131DC62CD1046372FFFDA53AC05CD438CFD4AA530D7B043F20E78F5E2732004
                                                                                                                                                                                                                      SHA-512:F10E3B644C5997767D6B4E4935B3DBC98E3BA3B5CDE69159E8F9231D2BC4DF5113F491BCA0B5087B865B802EF28ABE28A83ECAFCCFAD93C69C6AAA18865E6C2F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................!......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\images\ui-icons_ffffff_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):6487
                                                                                                                                                                                                                      Entropy (8bit):7.90376532755891
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                                                                                                                                                                                                      MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                                                                                                                                                                                                      SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                                                                                                                                                                                                      SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                                                                                                                                                                                                      SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\jquery-ui.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2363)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):36696
                                                                                                                                                                                                                      Entropy (8bit):5.283245047820083
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:iPQnb/+vaW1e073DX9F5fyd9EZDS25ulak:pbGP73DEQDS2G
                                                                                                                                                                                                                      MD5:6FF4CE9688B7C01F7C6024120887AD65
                                                                                                                                                                                                                      SHA1:AA741D08DB2E2177B9AB068A038A162D3A9CD518
                                                                                                                                                                                                                      SHA-256:89237CD26E36F6874167B688F6CBEB6791E9114F91D3B0DC1F4057B86BA478D2
                                                                                                                                                                                                                      SHA-512:7F4F684205E59419A17918EF1B7A17224BFBB2272C7235AD3DE282039B05ABC0917B07BCFBFA16A87D784EDF1352EB9E6C0CE2913A0D17B621400A77377F0E07
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CHelvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=453326&bgTextureHeader=gloss_wave&bgImgOpacityHeader=25&borderColorHeader=695649&fcHeader=e3ddc9&iconColorHeader=e3ddc9&bgColorContent=201913&bgTextureContent=inset_soft&bgImgOpacityContent=10&borderColorContent=9c947c&fcContent=ffffff&iconColorContent=222222&bgColorDefault=1c160d&bgTextureDefault=gloss_wave&bgImgOpacityDefault=20&borderColorDefault=695444&fcDefault=9bcc60&iconColorDefault=9bcc60&bgColorHover=44372c&bgTextureHover=gloss_wave&bgImgOpacityHo

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\jquery-ui.min.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (29661)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):31467
                                                                                                                                                                                                                      Entropy (8bit):5.22786442951504
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:iPQnlcR8lOXHc11evaL5mqAnztm8HS1E+4u6GyzqYSc7nfZBhVFWGc:pOXHcEacqYz48Vu6GyzqIBhM
                                                                                                                                                                                                                      MD5:6152D14CF3B1E5E829032012406AD201
                                                                                                                                                                                                                      SHA1:7B1FF6FA9E7DDCC93242F7915DEC41B9B096AD58
                                                                                                                                                                                                                      SHA-256:E01DB16A25EEDA85CBA119C390B95AD68CEEDF00438DCBC63CDCE78F104F3C52
                                                                                                                                                                                                                      SHA-512:D91D7C3FF083A9EA1FFFD941CCEDED61F778EACD387D77E7B78C06038537217BF450ABC37FF8E63B956E0FD109106C4EFCF4383F2F7399DD5BBF79CAFA2E6683
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CHelvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=453326&bgTextureHeader=gloss_wave&bgImgOpacityHeader=25&borderColorHeader=695649&fcHeader=e3ddc9&iconColorHeader=e3ddc9&bgColorContent=201913&bgTextureContent=inset_soft&bgImgOpacityContent=10&borderColorContent=9c947c&fcContent=ffffff&iconColorContent=222222&bgColorDefault=1c160d&bgTextureDefault=gloss_wave&bgImgOpacityDefault=20&borderColorDefault=695444&fcDefault=9bcc60&iconColorDefault=9bcc60&bgColorHover=44372c&bgTextureHover=gloss_wave&bgImgOpacityHo

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\mint-choc\theme.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (1383)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):18042
                                                                                                                                                                                                                      Entropy (8bit):5.090247985518859
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:XQJrHDQ1PVPgqMp8MCV9F5fydVPd1EcIVggtHBgmB0iBfT9RhS2wV53skuMaaSQ3:XgPQVDX9F5fyd9EZDS25ulak
                                                                                                                                                                                                                      MD5:F7BBF6EB933B16269E354E9F219F05CF
                                                                                                                                                                                                                      SHA1:81997C38A9916E00E235A64E8B2385EAAA5D6F3E
                                                                                                                                                                                                                      SHA-256:5958C3E54F27C21BF2C6F52B4A2DF5D0D17BB6104EC8076A0F12D78E9B06E279
                                                                                                                                                                                                                      SHA-512:D3BB37E1084F699D1F51AFD547A78D167F311AE5D2F3ADB7AFB7766892BDB9EBC1B01A75C947A1279A482C870F77DDB654034D31699564228193BA03B2009EC5
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CHelvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=453326&bgTextureHeader=gloss_wave&bgImgOpacityHeader=25&borderColorHeader=695649&fcHeader=e3ddc9&iconColorHeader=e3ddc9&bgColorContent=201913&bgTextureContent=inset_soft&bgImgOpacityContent=10&borderColorContent=9c947c&fcContent=ffffff&iconColorContent=222222&bgColorDefault=1c160d&bgTextureDefault=gloss_wave&bgImgOpacityDefault=20&borderColorDefault=695444&fcDefault=9bcc60&iconColorDefault=9bcc60&bgColorHover=44372c&bgTextureHover=gloss_wave&bgImgOpacityHover=30&borderColorHover=9c947c&fcHover=baec7e&iconColorHover=add978&bgColorActive=201913&bgTextureActive=highlight_sof

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\images\ui-bg_glass_100_f8f8f8_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):324
                                                                                                                                                                                                                      Entropy (8bit):6.099280043808392
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPh8TUyKOku2PPbN1MFwLKUp09SAG2zgN+E3VKF2EMiVAVTp:6v/7JSUAoPhOWAvzS+E3V+2EMiVw9
                                                                                                                                                                                                                      MD5:43482996F3298BDE3B0C5DA39449BFB2
                                                                                                                                                                                                                      SHA1:859318FDE99F3D8E3B8D867EA90AC5B46CC96851
                                                                                                                                                                                                                      SHA-256:E625FD94AF14EBEA9BD79F5F72C4D099B9372199168D0CC09B0C12F731B0A195
                                                                                                                                                                                                                      SHA-512:3AE92C757E5A61D4973BF096408F54BE091166DC2E4126BBC4C0D766537E16B1B96367A8FB1F6413C16F39ABED00C1B278A63E3318A656E75976C70B2ECDE4D8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR................D....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......LIDAT8.c.}...a.."."..?.~.01801.1.|....!..7..C2....d..B...g........;x.....V..58.f....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\images\ui-bg_glass_35_dddddd_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):323
                                                                                                                                                                                                                      Entropy (8bit):6.118633877079006
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPh8TUyKOkKhOp1idiimfIazgN+E3VKF2EMiVAVTp:6v/7JSUUOp1PhAazS+E3V+2EMiVw9
                                                                                                                                                                                                                      MD5:849013BB9DD833BA0E53560AE101A82A
                                                                                                                                                                                                                      SHA1:EEC1D9611C6C3790C8F79008A69DE45B841D77E5
                                                                                                                                                                                                                      SHA-256:73E0C96909304F28CE03CD13929F0D99CF89F939DA3F6F788A6A3FD54C57BE76
                                                                                                                                                                                                                      SHA-512:EFB376A3BCCFF2A5F11D9BEDBD52AE36C43861A647326738FF5F5018115DFDEBB567BAD12E6C7341E6D87A6D0DE299673EC8DD28BCD663B6813D0D1065AE004D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR................D....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......KIDAT8.cx....a.."*....x..r..}dblax ..0..q...?L.s...0<>.......'...y....h( .yA..Rw.....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\images\ui-bg_glass_60_eeeeee_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):323
                                                                                                                                                                                                                      Entropy (8bit):6.136900547450183
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPh8TUyKOkKh2vC4mwO3DW2zgN+E3VKF2EMiVAVTp:6v/7JSUU2vCVzzS+E3V+2EMiVw9
                                                                                                                                                                                                                      MD5:6DBC2DF754AFE0B05C9A1C50AA797C13
                                                                                                                                                                                                                      SHA1:5703D4E46789D62A9B8F858A728254A91D320911
                                                                                                                                                                                                                      SHA-256:897B58BC1EC9CAABC0AB95CCEA0EE26FCA10BF9AA7A53D6FC0CBC56A4164D42A
                                                                                                                                                                                                                      SHA-512:BD2A5DF70345FEDADE86C361CF3D9670365877BAD81F612ECFB201FED93B068AE4009153A5A373EFA408324E2E7A0AD7CB9FFA79D0D5420F3ED301E127C3772E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR................D....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......KIDAT8.c.....0.F.........b...b....."..p....'0|......./.c!..._9.......h( .m[._.......%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\images\ui-bg_inset-hard_75_999999_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):310
                                                                                                                                                                                                                      Entropy (8bit):5.999011311090708
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPedUyKOkiAFl4BK7yRTh4Dag2zgN+E3VKF2EMiVAVTp:6v/7WdUMAfgK7yRTh4Dag2zS+E3V+2Ek
                                                                                                                                                                                                                      MD5:6767DB53D8EF6F2FBC454B9AF8540601
                                                                                                                                                                                                                      SHA1:3708375F44492D32A6376BAB4AAAE15E1AD3574E
                                                                                                                                                                                                                      SHA-256:E2E788B2F4D440B4E4A8B306B81B8AA519994095A3FE7DF78BE1FD139F55D785
                                                                                                                                                                                                                      SHA-512:568999EB273ED5C9794C539834F964F46CEC0C046810BDB396D07CA15AAEA5445240565BBF5D48AB7DCBD5129F5161DF08677F90EF614CE860973733E3D38E47
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......>IDAT....Q.. .D......5..{.T.2.r.@........JE..u.q....D....E|...zv.;..]n...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\images\ui-bg_inset-soft_50_c9c9c9_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):329
                                                                                                                                                                                                                      Entropy (8bit):6.159377583111018
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPedUyKOkjPE+qfyznFF39vzgN+E3VKF2EMiVAVTp:6v/7WdUjnnF19vzS+E3V+2EMiVw9
                                                                                                                                                                                                                      MD5:06F61468D4C682CF8C40D0B2DE2472C7
                                                                                                                                                                                                                      SHA1:BC120A19F11521F55AB011EFC54519484296A801
                                                                                                                                                                                                                      SHA-256:BAD2807409F8E9A151F6316BE68E110504D0C87A3E7D27C692C919C7F382E3CB
                                                                                                                                                                                                                      SHA-512:1E203FD7BEB683DC5D098362B0DC9B833B1786EA56DBD8045F708E3585662EAE9EE7B7979F11A2FBA86F7D47F2AE22AA45B07D115F1E63467D5FB6CD3BA7D46B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......QIDAT......0....n.TWd...s..%..Z.....0.$'>y...$4..e.Z...........m7.x.~.v.....)...<......%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\images\ui-icons_3383bb_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.7748572558304305
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:hNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:pHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:0787C6BF54A66814873CEE2CCAFA9732
                                                                                                                                                                                                                      SHA1:D78AA4DD126A140219E5E74F7A1FC188DAE39B8F
                                                                                                                                                                                                                      SHA-256:77D68A1D57B4D4FD319BBB155BF72FCE8394C9DE6DFB1248FF7BA557580978BE
                                                                                                                                                                                                                      SHA-512:ED22D62D27DB114053855A9E4FE6EF0AA5B8B1B7F02FA51D4B9EC2F0A213D875291D70CF378F2B062D9F856E651264C7E7F8A60EAEEB2C3C67FC7603D6A32D3C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3....]....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\images\ui-icons_454545_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7090
                                                                                                                                                                                                                      Entropy (8bit):7.925434318681863
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:Tbhz1Ogz+PpLVLuOyc3AJzX/7N/dlbNPtGzQ4gGdBcFk3v4Ql+p23elLTJVaXKkH:NQ3tIOj6/dtFRCMmgo+p/Z9UFAhKDsHW
                                                                                                                                                                                                                      MD5:5C3BA680CC34CD9B30855C180474A152
                                                                                                                                                                                                                      SHA1:91FFCF4A399238C121F42951BA801E7C5030C1DA
                                                                                                                                                                                                                      SHA-256:33EEDA3A7ACEAC3E727FCA686F18E8736824ED4A1FCE72B8952F01EB2356CD77
                                                                                                                                                                                                                      SHA-512:4FD4B8000F8059C5CA9484A3B61EA10C1323110336D924983D3473F489A4FE7E417DB2AF4E02433BFE017831E6B80CC427C00531EACC55BFE6D2501CD2686269
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.E.;.-....tIME.....%...'E....IDATx..k.%Gu..m;....!.^...p.l.0..[..HX..H...:w...8;.........g1s.....].&..<...............C.lfq..!,."....Wu...{.v.Gwn.>U.UuN=..S..x4.g.:...........6!.Agb3.. .6+.J.D...0...&..s..N..._..B..s..&.&..>~.=...c{v..j%.._.D......Y..E...F.q...G..........R.S.C....E...!..'..NP)~..t.=;..w.me.BH{.s...S......&..S..6MCP6.z..!(..hnE.6.Vj.cO..6.y7..i.~fK.......j.T.0....<.2.......6+..^;..4.~%.....px.h8..4.^.../............:...2..n..6eL.h.`~..=u....p.....r..n.0s....Os.....Wr...G...h. ._..C..mz.-..=.)w....Fi..#...@u-c..P...O.{.S.s.^|B..A.'m.TQ.....n.`..[.......|....t.7.^..p......@........px.h8..4.^...s....C8.U..k....N..}..A. ..*..s.%......~...a.JYT}.-....1..pT..V..P%.%...?p(.>~.PA.E..........]..1.^.....(...[#....\....WR..>4j"m.h...I.@I.>]...y.........A6...........E:..q7.......n..05A...uP..y.L.8.Pj....K.9.[...E.Z............L...u.....L....;X

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\images\ui-icons_70b2e1_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.7666744210772265
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:BNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:JHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:2BE9B4C61F3F58F52921F7559DADC676
                                                                                                                                                                                                                      SHA1:C9F6E9C405B4A057B9FDEE94ABC8B30194FFAC84
                                                                                                                                                                                                                      SHA-256:2C9608B1927D4286185C91E19768EFA3C74116775422FCF75BEE20414B9E3DED
                                                                                                                                                                                                                      SHA-512:9CD07A4EE9D87F43235591399FF2973FAFB84D4741FAB2CD3016057A3EA56194172AE27EB1C8D679FF406CBB14A7840395AC696B2DC3BD0183ED229BDA978884
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEp..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..p..ni...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\images\ui-icons_999999_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7111
                                                                                                                                                                                                                      Entropy (8bit):7.930568719726226
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:gbwMxnYMuizXrKo/5WqxtAqeHLyq/SFR5Xi34CbgAXHs43bxpMhk+3Amt4Aw+eZH:DMzXuohHkyEW/tCEAXHBg3Uqex
                                                                                                                                                                                                                      MD5:CC407B338A9351A370F4895DBA384B24
                                                                                                                                                                                                                      SHA1:42206A8D67AFB9435BFFD1579663EBE1A18AEB29
                                                                                                                                                                                                                      SHA-256:33F6E407E7B5858DF77AAAC1848B0451FBE494AF507233AFFE381351AFA0421F
                                                                                                                                                                                                                      SHA-512:9AC2F60405850ABC8CC8AF860C20C6CCF1DEF1E44E91D2D895EE4B14F6D8285E5D3E69F26C0B4E2044C01B2BA9E5142E9C733A8646DA521A75CC422F2418CEC3
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..#^......tIME.....%...'E....IDATx..{.eE}.?.H(cX.1..[R.`....J.H..E.$U....cE....Q.2;#...f.c.,Hj..cQ5...5P...qK.......$...1....%'..W.9.:..;..=...s.=..>............d.5..x..^.../.2.........mV..&.@..`..MX9......$)...=.,...0L.L...}.0~z[.....J...5..S.#.G....p_....I;,.:q! `.X% 0.\..C. ].H.....B(T..(..R....o{vX3.)...........6h.>...XhN.^.4.Ab....!CPz%..Lm0..m...m..n....m...9.c.....].=.UL.W..W7..)........6+..^;..4.~%.....px.h8..4.^.../............:...2..n..6eL.h.`~..=u.....(.#%$....4`.*.3h...5m..m.......5@.. .~5<.e..........n.oF...|..d{...U.^@...>]..L..-oz.....e..%PE..f......$\..')y8J..^k.._9&.t.;..o2.:....A.......@........px.h8..4..7..:....._+-..s.E.K%.2..5..UA...(.<..`......+P..3l..X..S..G..n%p.U".YR.[..........R...q._`....P.5`..Y.BKl.5b)....Z|.......t.Q.i.E.. Lc.J..t.S...Ch....Jgn.b..(;...Z.-..tVk.n...R71.%.5`j..i..@/...uq...4s.h.`s....... ..]&.Ua.q;].A.....

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\images\ui-icons_fbc856_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.777593739887738
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:yhNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:ypHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:908D7C74656F60D6716E090009B7D21D
                                                                                                                                                                                                                      SHA1:6D1A63B435DEFFE5B9AC3C74586BAEAE94F2061D
                                                                                                                                                                                                                      SHA-256:A70457FDC19FA40C6DF794C8184AB93299DD41B0CC2C5210C7CCDFF9969B5231
                                                                                                                                                                                                                      SHA-512:4FF4F94B1648934F3813913AEC11D86F9F94A219F7D6F682CDEEE4C0FA41BB5016AC4327BD3B32B2973C3F69005A1ADBFF1EDE3754CE6A40CED179FC005D17F8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..V..@....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\jquery-ui.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2363)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):36520
                                                                                                                                                                                                                      Entropy (8bit):5.277612528633452
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:10OW0O5tb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHQPkvvr:K5tb/+vaW1e07GF5fyqEEDS25Y
                                                                                                                                                                                                                      MD5:66A05DBB5BAC293CE476E43E7F69A538
                                                                                                                                                                                                                      SHA1:5B623FE7B333AEF8731B6503A5829924483E3BC4
                                                                                                                                                                                                                      SHA-256:0D3BA52CCB0BE4E696E0CD7D65C04A51C8476FF8CDF1C988867313CF670B26B6
                                                                                                                                                                                                                      SHA-512:079907953FC4D5F085D00D6D39E17C4C37DE4AB2C262AB4972D1056CA6C78351647040D101487F0E37EA526FBD60DDB2762D311FD00BD2A77CE8C4C34872C35C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CHelvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=dddddd&bgTextureHeader=glass&bgImgOpacityHeader=35&borderColorHeader=bbbbbb&fcHeader=444444&iconColorHeader=999999&bgColorContent=c9c9c9&bgTextureContent=inset_soft&bgImgOpacityContent=50&borderColorContent=aaaaaa&fcContent=333333&iconColorContent=999999&bgColorDefault=eeeeee&bgTextureDefault=glass&bgImgOpacityDefault=60&borderColorDefault=cccccc&fcDefault=3383bb&iconColorDefault=70b2e1&bgColorHover=f8f8f8&bgTextureHover=glass&bgImgOpacityHover=100&bor

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\jquery-ui.min.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (29453)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):31234
                                                                                                                                                                                                                      Entropy (8bit):5.219784610390886
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:K5tlcR8lOXHc11evFi1kzqms+4C6GkEtBSc7nfZBhVk:aEXHcE+kzfoC6GkEtfBhm
                                                                                                                                                                                                                      MD5:CBEAE3A1C196A22080B7FACE12BE6A22
                                                                                                                                                                                                                      SHA1:F9D0A0CEF0F6F3A1D69C4F06B7E192D1406B7DAE
                                                                                                                                                                                                                      SHA-256:592C4AB8112A3C45430AE013B3CDD99BDB74EF03FE18C958DF71CCD2ACEA77F5
                                                                                                                                                                                                                      SHA-512:BA1459D043FC2D60A73D38621AB5CB488BAA8383BE8CF556012A04B1A45733B7F6D1F96BB7293ABF78C44F41CF83C5E398C65FB4D2106E5E0047614C8680D053
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CHelvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=dddddd&bgTextureHeader=glass&bgImgOpacityHeader=35&borderColorHeader=bbbbbb&fcHeader=444444&iconColorHeader=999999&bgColorContent=c9c9c9&bgTextureContent=inset_soft&bgImgOpacityContent=50&borderColorContent=aaaaaa&fcContent=333333&iconColorContent=999999&bgColorDefault=eeeeee&bgTextureDefault=glass&bgImgOpacityDefault=60&borderColorDefault=cccccc&fcDefault=3383bb&iconColorDefault=70b2e1&bgColorHover=f8f8f8&bgTextureHover=glass&bgImgOpacityHover=100&bor

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\overcast\theme.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (1358)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):17866
                                                                                                                                                                                                                      Entropy (8bit):5.078458550790552
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:X45UPkvvLGF5fyg53EcO32B+yjgmB0iBfT9RhS2wV53skuMaaSQhQz0iIh20:X45aF5fyqEEDS25Y
                                                                                                                                                                                                                      MD5:1DD5554BA234E75BF2BA13CBA7DE2FFD
                                                                                                                                                                                                                      SHA1:77D8E0898C772D0F478C912C12FDB10299C26E23
                                                                                                                                                                                                                      SHA-256:92F063EF8E21FEE9BD792812BC72407F4D55F81AEBAD6668B7BEE9B0C8C786B5
                                                                                                                                                                                                                      SHA-512:26DD2069EAC13D9F4262EE6998944EFF6152C7DB06B69F8198A4301B39723CB7BEC4FED3A36B906A0451912A737B97EF53F86F1E08F465B49AF59AA818DE6383
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CHelvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=dddddd&bgTextureHeader=glass&bgImgOpacityHeader=35&borderColorHeader=bbbbbb&fcHeader=444444&iconColorHeader=999999&bgColorContent=c9c9c9&bgTextureContent=inset_soft&bgImgOpacityContent=50&borderColorContent=aaaaaa&fcContent=333333&iconColorContent=999999&bgColorDefault=eeeeee&bgTextureDefault=glass&bgImgOpacityDefault=60&borderColorDefault=cccccc&fcDefault=3383bb&iconColorDefault=70b2e1&bgColorHover=f8f8f8&bgTextureHover=glass&bgImgOpacityHover=100&borderColorHover=bbbbbb&fcHover=599fcf&iconColorHover=3383bb&bgColorActive=999999&bgTextureActive=inset_hard&bgImgOpacity

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-bg_diagonal-maze_20_6e4f1c_10x10.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 10 x 10, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):354
                                                                                                                                                                                                                      Entropy (8bit):6.1856798088703915
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPIMUyKfp5EjkIEFFU8agLyACE1jAtyfzgN+E3VKF2EMiVAVTp:6v/7AMU9+mU8aEyaAtyfzS+E3V+2EMiw
                                                                                                                                                                                                                      MD5:8E54CFD7DE41844B11EBA7D8C6A0D190
                                                                                                                                                                                                                      SHA1:E42F0848BD4702483EC12830B17F16D52AEE446C
                                                                                                                                                                                                                      SHA-256:21CD36B1BA6C9F13E4FCCEAA0181DD9F93859C49CB99402F82EBF622AB5500C9
                                                                                                                                                                                                                      SHA-512:314F99E71C85952B876E0014E654F849D6D13F7CAC753607B2755BDB4B9579008867CF93559B4E39E5AA96EFAFA16B6E45CCA03C41A195A700A1425DB95E67BA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............R.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".......fIDAT(.c......a`````..+.W....w......8D..<m..&d......6...2.....ga...F.t6...........G...W.c.A .p.<."5..*..m.....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-bg_diagonal-maze_40_000000_10x10.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 10 x 10, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):301
                                                                                                                                                                                                                      Entropy (8bit):5.8094407899272555
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPEpFMUyKOkYmF+v6ZOatLzgN+E3VKF2EMiVAVTp:6v/7YFMUOmF+6TzS+E3V+2EMiVw9
                                                                                                                                                                                                                      MD5:FEBF32D7E54EEB847E50A642AC71164F
                                                                                                                                                                                                                      SHA1:655D6D8E685ABF751B93F90E7DA27A11ADAE8CA2
                                                                                                                                                                                                                      SHA-256:8D123AB9E67782510FA4B8E6880C4475E925298603EC85FFCB2E2B1D0D13D57E
                                                                                                                                                                                                                      SHA-512:E2C3F9D7642CA4807A7944496B6003D0E2891C2AE8B13CD1911F9571DC56D6F55C45C52D494BDF9E00A8E0CDFCD96B00C0AB642664A2DEFB47EF1570B950CCFC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...............L"....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......5IDAT..c````0Nc`@..i..`..,TU...i.!&4-.gg..n...P..E...c..&.A.....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-bg_fine-grain_10_eceadf_60x60.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 60 x 60, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):10817
                                                                                                                                                                                                                      Entropy (8bit):7.975179355860076
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:5m0I5zL5Wt7yuMsf0OoCB+05Sn8erfrZanjySFjhGp89G:olv89yPs/U8oTZPyhhQ
                                                                                                                                                                                                                      MD5:DAA0366C4F4C1E13878D2E6229FBED41
                                                                                                                                                                                                                      SHA1:45C336830C04472C6746F5B8BB8142249E209C3E
                                                                                                                                                                                                                      SHA-256:B3499F4966F2118AED9858D3119598000A0656738D0212ED26585692A5734799
                                                                                                                                                                                                                      SHA-512:753D2A3E627D9622209744835D277C5407542C88AD30E330D727059E23CB37401541E09D21A2A6EF28C2DDBA3A7B25F0EE4608AD555380D6CAAC4E652488D4F5
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...<...<........f....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......)EIDATx.}\y......vE..E...T..B.....&.3.3.R"./..,v..64(N.2..d.t..d.j.z.z....n..o..........g.{....G...?<oxx$...........3U.j...>.....!...{.L...E6.............[.0._4._...B.P%tt..n..f..k.p;.VRA.....X.2(..O.J..9....].CS......j-...........*T......[...cA...&......~5..m.;....=b.j..U....o...UL.3....D[V..?..:G......IY......[..."...{.......kx-.A.Eo..=H.T.l8.~.)q..#u.m.zT.....A;.f..J..8.a..vn.)o.~.....,[Y7.5.g..{...|a>....._.^...)n..C.p..o....}zg............V.N]..."f.).;..>cg.b.>.vf]....GB..%.....ei.B[.K.I..I_.7.3d.."....hvS.........H.[......W.#.W..u..E...._...iYE....v...4......c.hs.<].7....W...u............w.T4..7.?.;Egq.....Yhn.W.jv)..-..=jn1%..Jx5d....8.M..B..(....P;.V....#B6n....ri/..T=...@..*8.q....T@.. ...B.........qw.=.6..GT#u...>...oqJ......7.mS...CW....v....d.zIM.M..9Y.a.YD..*.A.Q...\..un..d....-<.T3W..X.&K....v..H..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-bg_fine-grain_10_f8f7f6_60x60.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 60 x 60, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):9962
                                                                                                                                                                                                                      Entropy (8bit):7.969618322180041
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:5vfrOe0KqRDuvFYV/XAberk2b5wtdT79tYGd/gogGVnP:x6e0LavCV/XSCkVd31/i8P
                                                                                                                                                                                                                      MD5:9224F99A2486AA6685BAAE76771E1EA9
                                                                                                                                                                                                                      SHA1:BC890EB71B1B0BA6A2E83C68E9AB531943E7579E
                                                                                                                                                                                                                      SHA-256:C38192FDF2C50DCC11C75619E36D7A70B2E42A80988A5BA3540C7A86594D5D99
                                                                                                                                                                                                                      SHA-512:92A60B05866D1E66F1E8E0BD4ED14DEC5450564C6ABD9CF105FCB20EAE2EAC38DE12E1296943CC3C97FBEFD43B50177F6387FFCE0BFDFCE38724BCF85683B0CE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...<...<........f....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......%.IDATx.|i............J....T.82.pe.d..D........("..E....A.. ....8!.Q_...j.......buw..c.|_..`...8....]].k..^......}7......'.O..f.y..R...*../.m|G...W..y...z.F=h7....e..\"...p......c..di.F...f..l.-.n.n...........l..j.R/.E=.X3.......r..&..?...8....R.......}...X.$...z....Z..l.<.}....rs...-....[..........=*. .........O.V.C.s.J.....YO....~..TDE4....>:..R...o.["[......j..<.3..z...7.z. A..a{.fuo}..._...{.A...`.=.^ ..........42..cf.....H.d.3.:.j{..J.h........l0....r..U....f...b.1d.....toQ[jG..|..|.....~.]...zi...u....SL..^........xa..o.{.W. .Ut..1......{s.i`.a.-Y.....D=i.-..i;..z..O..mmO{3/mw.Z7.....K..?....L.U.Q....J..]W>..Z1....l.tcfw.S.2...).Y%/..Q.)%.N5.l.mZ.5..b'......k+Z.:V.S.(_.....f.m...e...wU......~S.}...~..*....?...'.3.).Y%/f.U\\~Y...e_../m..\..O.ckW.#s....r...([.^...kU.5..7.-.........PR).R.u......J\...x

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-bg_fine-grain_15_eceadf_60x60.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 60 x 60, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):10587
                                                                                                                                                                                                                      Entropy (8bit):7.970596955089787
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:5LS2mq5Hlu+29ey/FtpAemynhbcA+XQ6nqrpm4owj9euLJcblTr85ABrA8pyCyj+:d3G+U5FtBnhbcAx6nz4ow7q/85OAgyCF
                                                                                                                                                                                                                      MD5:1573724BC760CA865BC89E04AFFB7A8B
                                                                                                                                                                                                                      SHA1:82BEFD0ADF9B01AE7D23D3FA523B1BA977C07670
                                                                                                                                                                                                                      SHA-256:4025C124783C830B3125FDA65E78CD732D51DB58C451C576A0F41B269DA8BB0D
                                                                                                                                                                                                                      SHA-512:6249A5BEAF3387F2607AAFA6B905D8EFE62A3227518803CE67314983FF0613094614621DB3E6EFA8E287C6667CF3A8711EDA54EDF58A3ACE8BE920CE717AF6F2
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...<...<........f....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......(_IDATx.\y......w.Y.(.ET..B...L..6.d/D"..:.9...r..XC.d.Fs."EB8...#....>....u=s..u..........{...s.../<p.Ea[]I......g..]...^o.xG..SK.:.b9,..."_...t%}..9...I.j%..Z...0..c..j......Bo...;._...r.l{.U"w.........SE.....S....Mw....ac..9R.j.iU.sq$..u......to.......9.....g..A.....G.==.;........}...tg'../.w......o.ZN..(J.........Y..Z......W.$..4M^e..s./.....:..+.@wP..d.~..j."..V.-I.......,..-E..........e...)._....\...J.. ...{.9..`.8"v...p7..a.X9v.[.-q..[.....'..gp.......:?9[.ZP......'.a.8.k.....4.5...V.8y.-a...>....wop/9wXoX....1E...&....<h/.V..#._..o..|<D.o..'.~^3..:.\R....&.Q..1<...9..K............5....j..u......b!LG.'...Qo.7....w.8?...~......^...M.e.X....v.{.......................w...q5..K:..j.....w_t.w............ ,~......1Et..r.|..f.XW.S.T.C=....X.rM+N.$c.oU.UW...n..{U..nuf1..Z..#p......'(.W._.\....V.\...^.W..T.....N|.....[

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-bg_fine-grain_15_f7f3de_60x60.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 60 x 60, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):10949
                                                                                                                                                                                                                      Entropy (8bit):7.975286464162133
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:5Lf8jio4bI9ZPFf6lmEeBKELlTqD6cfkZVw2GIqmn+Pem+uegXG3:FI9Zh6lmpcKlTqWOkZZwcOeXubm
                                                                                                                                                                                                                      MD5:0692EBD90503C937C0CC42F314B217E0
                                                                                                                                                                                                                      SHA1:90775634877E018BDE5CCEBB299020173E5EF4CF
                                                                                                                                                                                                                      SHA-256:12C9647B8E4802BC5D9446AB0CD00E717A679C5F3058F958A1EEEC5571059AC1
                                                                                                                                                                                                                      SHA-512:1981023F51D335118F6A7F537C3A09193F2B00DEA453BFAA67C5C2D209B57C24AF339004029FD9F05AFC300FEC2C9F845F33C845077AF329B276C08CBCB76962
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...<...<........f....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......).IDATx.|{.U....>..0).9. .h..LBD.RD..B....8.......%...qHD......IB..3..>....Y..K~.....z|.......Y...-.[.5*l..j.o.....%..+.#z.~O.....QS=.^RJ...i.U.:/..tL.EMq-...|.B....~.CDD..."54...I.........s..uN..j......S9....e...Oy..`F......:...d.bU.g./Y..&]..:.....Q.G.L...v.t....r.n..;....>AA0....=...S....7......s.D..p.O..y.......t...i.._Y...._V-...".wov1{Mw....x.FPm.J.....q2........q5.E.Sl...a9N..g!.0W7.sZ......r%...H..rO..Gm.1....0..ZU-O......<..J...&o.[+.1.....n....%T0....q.r..P..~.w.. -..E.v.....g...K....4.f."1O....Bo.{..;..!.S....W^.w&D..V.`|...cr..........A#...&.@}.n...r....i...]..voK........a..+~cw.5..d-.{.6..TGR/...F..z......hqx.8=j...8oA(.S#.8Z%|!...A../_....`.....S.).....C^...Wc.............'..2..v..&'.r...(#\.j...vS...zP7._US.P..x..I...4.....~..:.2..=.~....3....(sF;...B.8m...A.........h.}B....."...H.tM.S6.)t

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-bg_fine-grain_15_ffffff_60x60.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 60 x 60, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4262
                                                                                                                                                                                                                      Entropy (8bit):7.870900539604215
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:qcNc3q3cwzxGSqXP5iizWuPWmaDWrdZdoYuc:qV63c46XUiymTdZdNl
                                                                                                                                                                                                                      MD5:CAB25AF5D888E338ABF8830001268063
                                                                                                                                                                                                                      SHA1:266CDB929DE208EB666459B21E1A698403602502
                                                                                                                                                                                                                      SHA-256:406BF03A738DF2A719785300DE43D73C8DE06C51F770A287E96C77369289FED3
                                                                                                                                                                                                                      SHA-512:BB55B80BBE7709A564262CCF32BD42EF9EAE25ADC771158C0088F0401EB6AF0E76CFE458BD5FD2419B6AD647E04D1D78C90D174D8746B7A8FBEC6C8D4D8F6E3D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...<...<.....O.Z.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."........IDATX.mY_.,.Y.s...s...E|Q.....&...Z.$.2!.(1.<..]P..>:.a..."....y..E..e.$B. ...........b.....A..z.....7s.F...9..Tw}...}..N+2@*..C.1.@.S............`.-F._.t55nH=..:.SO........".d\....@...3.R.-[..Y.=.qO.7p&..J2.......>.K.[..o.2...@.......9.Y.q..,...(.X.=.Y*...I}Z....#g......R....(?G.5u...-...M=m.>j.K......|..c.D.8..:...&.`.j2...D.T..>.Y...&....:.........'..Q.u.....}.......5[ .!.w@h.......J..Eh.4Y.Z..c*1....Q..2dX......gn`...#.....c..L.Z..}...1............:.K.VX..........0..W7D..o)O=kW{.j.X..RE.(....T..k..kj...D..Gv..m...S.Y...r2..P..2.R~:... .......:j..,t:.r.R.Jo...lS....0..3.)w...r...X... ..N..0../.R..@.../.m\......j...[*..-...V..........R...$..8.....ApA&..5.%..-[_....b.......n......."....;w?..+u....Z~.?|....u.....Wn...v....7?...O.|Xm......{...+...#.&~E.K...#..U..G..w..._B{......+.p..!...K..6..<c.z.P.1..Df.B....gn

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-bg_fine-grain_65_654b24_60x60.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 60 x 60, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):14498
                                                                                                                                                                                                                      Entropy (8bit):7.981807801007253
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:W6r9F7HYHPQlAq0izgtUYKO6OH61y7On6mbbvb:hr77jlXMtUmzEcO6ST
                                                                                                                                                                                                                      MD5:0DA5C3834D6BE7BE8626B10311D7D42F
                                                                                                                                                                                                                      SHA1:79495C88AD23AE852925658F05858128F5B8F9DD
                                                                                                                                                                                                                      SHA-256:861A442B54D565C15E61A9BB056223B2D21A2E7ED7C245A9A2E701CFE55F9BD1
                                                                                                                                                                                                                      SHA-512:F6D61966E32F737F182A8A91C5729E615691E1FDBE30391D72B9198D41BE2ADF353FFFEED510DEAD0905271830D71ABA88CE267D1D7F4F1CCE06D2505C4174A6
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...<...<........f....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......7.IDATx.u|wx.........7.BG.$."..HG....AE.E.EAA.Q@.....!D...*.'$!=....3....|.{.>.Z6.S.=.=.y.......3.=}.9`..l.V.9T.....-..#N..V.}.$K/...H...(....B.a..'.j%...ot.T....*|..B.... .m:n.L.v.e.N.u.ehr...L..4>|.EQ).j....>f...--..)ldR.bZ.h.6.~...U_........|.(e.a%.2.|A.........wg|.Od~.qg>..Pc*.F.}...+\W..x.....~..OF......).....|.s...."..Wh..[......+z1..C..K.....#m.r[....X.L.sA..-..1./.....W.a."5..F9h.~..uxR..e../....*.s..p..Hz$di.g....}.....6. &S'..&...././W_.gS...M-Y6GB.(WF.....:.P..o] T.$..k-.'.T....N~..}...'y>.-f..4:.'..F>`...4:i{..h,:.,Je4!...K...../.K.m...V...%D)1...=t....y..6?~.,....QX.n.?...^......W*~5!._......=.X'...S../......gBF.O.-.F{Z..m.6M;%>.\..!?.}.(..C...d...!../..j[.lR.7:......U..9k..+.-.=+.....B.f.p.2r..P..e.m...f.Z{C;,....P../.b.P.....C:..U..7.nC.$..w......]...D.x>..d..L....r.B....~..2. \....5.4..'....l.!......x

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-bg_fine-grain_68_b83400_60x60.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 60 x 60, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):11935
                                                                                                                                                                                                                      Entropy (8bit):7.974771171812448
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:5808KiNNatDpFdo+f5vdIEzqTq+QNzNkb6JeW4aDD73XIR/hC05uJz8jlhAT9/E6:sratVFdoy7qTq+QV26J/4a/73XItxCoi
                                                                                                                                                                                                                      MD5:A020D1BCD94211F5586B0F8E9F2EF0C0
                                                                                                                                                                                                                      SHA1:3967D2426F4BB056314ED6B98913101EE87CC77B
                                                                                                                                                                                                                      SHA-256:6F34FCC0397A1751505283E1FF893CA6A8755578B2A7C20737B037C74718D6BD
                                                                                                                                                                                                                      SHA-512:ABE69894EE57DEC8F0EDF00BD3F7FFD85AE4CA87EE45A6C87E404ECE01514BBCE3F3BAF2EBCF08EF0B198CD182EE5E8CF3058F17B5DB2B3A0721754B97C90B95
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...<...<........f....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......-.IDATx.|itSU...7I37I.y..2..B..... ......# .8 .A.Qdx_.'F......ED...R....M.4.xo...q...{...GWVrs.9......;...;.|...\._.....>.T........i.p..5......I.tB..z..T,|.4r....Wt.,+.....5x..B....t.{N[~..%..t..X.......;_l.W........rr....T.F.Z|,..0.im.4....=/...u..S.uvZ..Jr....H~?wc..0$n.w..s.....iG....`G...V...:.|.9.......5Miy.....=/55..wF..>7..I.E.6.1y.:....../G..n....:........=c.p........pG0C.\..!....;.w.pK.%...D*1.m...\.X....h..m..-.U.q..GS..M.:{....`."oc|\s...3.sz. ...t..x...l..`.T...^;.M...k...Ew.....T.F..n(?..&..K.\.pg.b.....u{...W*.........x...%....Ll.x-.h...Z..<c]....b.P.+.......<Q.. .8v$x.W:.C.......r...P.../..../.X.|.r.sR.;..8Z.....V.oZ$..4.........Ri....d.V......{..x$l....ox.y.`{m.X...&.#.....-...=-..4..HR`...\Pq^2*ST'..y....2O.#f...Z<^..\.:!8..N.q....." ......x..N*O.>.R..r..)H.Xl.R.|RF^%.{Dsx...;.3.V.KH.......G

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-icons_222222_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7025
                                                                                                                                                                                                                      Entropy (8bit):7.929805003010536
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:IcH5ZfLGSAsNh7vB1PP0M6hPmBmc8aWkRwP4:xHjLV9b7vbaxNcbdKg
                                                                                                                                                                                                                      MD5:23ACA9C182696DB96FF9EE5BF9601461
                                                                                                                                                                                                                      SHA1:F2FB72129DB2BA61E5E9E572B24D82FB93ACC3F4
                                                                                                                                                                                                                      SHA-256:28D8B65FD4815EBFFB752BEB60B976D22E8BD4004194B8CFDD0E9A14E39814BD
                                                                                                                                                                                                                      SHA-512:F36FE89779D9EEDD2456826125166428824ABD33C999B187F69F976F51A5FAE7A2B286B44C4312B7B920BDBE0F043EBB652723962267489EB0B575EB5179FEC0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD."..b.....tIME.....%...'E...TIDATx..m.%Uy...$.!,h. ,.%..&...@.|I..E.M.r...D.....2;.f.....A^$5...j^.K.@U.....-.wW...D`..|.q..".t>........3}.S...~.9}.<.>..<.yNp..M.)....`...px..h...t%....y.Y...D.^.`..O..r.%`.:.$%...{.....0L.L..?..a|..6.....]A......7P..'@/:.]5JH.&.ay.......2....:.8t..y.....@.....#*'..?..t.;.Yw.m..........{.>|Dg7..\J.{.4..K.......3...t.f.Z...`.7.u7..Y.~f].<.....4m.*..<.%%...{.^.`....FR........l8<...O........h8<...O..........k.2..n..6cL...`>.]=u........$....,`.&.+h..k.6..J_*|.K.0...?@..lx..do..m.]..L.3...0.;......T.E,;...4......t...MO...mP.L..U.A&......e...+..`...8u...].5.7.7.~"....h8<...O........h8<.....]..C8.Y..s....Z..}i.A. ...).s.W...!.m.........z.[.#...R.....\R..{...v..........r.....R.. .?.#..[.|.f....`.........y...).A...-..Q.N..4w....:Kr{.......3...Z.P.!0t.{l.\.Y..wSn.P.IA..Vm..-.R...$y.....sI....@;..e.X...v......Y.v...B....n]g.......W..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-icons_3572ac_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.773976636383107
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:5NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:hHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:6050985BF56D772CAFD9CBBCF250A1C6
                                                                                                                                                                                                                      SHA1:DECC56F1C9D6EF03F460AA3C05501F832200B974
                                                                                                                                                                                                                      SHA-256:827F9976FC547BE3ED6E1C4D26EBBF29541A6622DF34BB54D93099D5D6B3A89C
                                                                                                                                                                                                                      SHA-512:167D88C7375DB41B0D39AE27A6C96269B0A251711BC807856F0CCE953A525A9FAB87D08256FC917668F5D215C3EA5D2E396CE8F8D4F53C4BD61F5F742C819FD2
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r.5r....#...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-icons_8c291d_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.782986442029293
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:vpNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:vxHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:48EB999570CAD20502F8E097D5EB06E5
                                                                                                                                                                                                                      SHA1:5971D205A8D5D3998D0CC9324FF96B89D32574A1
                                                                                                                                                                                                                      SHA-256:A7EFC92E8E7DF84F638AA5F70E885D980B021B395A34848F018D02E88136B660
                                                                                                                                                                                                                      SHA-512:59D6EA123399B752374D9EDD8D50D9EAC0BA08DE098F9D9C4FA6D2C46DDA4F5AE2164B81BE930C6A189035FC84C24069305DD558B5BF1A3C0B2A36C7B1430CE8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)...]....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-icons_b83400_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.746555948985092
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:sVNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:slHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:95EF27B1709696916D21651EE58D3DD1
                                                                                                                                                                                                                      SHA1:355755432E0AF2450681FBE77D87D41858C0DC2D
                                                                                                                                                                                                                      SHA-256:7FD672DDF99D36C9429B78B8D16D579E917B9894C0686C171C3EDC568A0F14B0
                                                                                                                                                                                                                      SHA-512:9274CC96C95E84427C9E71B5EC476D916489CA113B53D3163E7D8AD6E6499A042F18FA584651418F3A446FCF9550D7886FC700BD730F00FB25F1C618F27CF85F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4..4.R).....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-icons_fbdb93_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.776149396506033
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:5NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:hHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:4A74B78D6A9AA2A787E1CFBECFEFF7D7
                                                                                                                                                                                                                      SHA1:8CF70518D6D29FB3D57EE0B6A861308DA6B33383
                                                                                                                                                                                                                      SHA-256:3CABBFCE55BAB5BA6DA058F7BADD6EB850BB2C9F3482B985CCC2E91D52F52229
                                                                                                                                                                                                                      SHA-512:E95BD2A3BC0FE051FFB1537DEBAED206309409B910502E40FF918A62FA55080FD2E134610BF7EAC483D8AA6D3CC93B9892FB3903B41A47426F7DA38D8C6D744F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE...............................................................................................................................................................................................................ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\images\ui-icons_ffffff_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):6487
                                                                                                                                                                                                                      Entropy (8bit):7.90376532755891
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                                                                                                                                                                                                      MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                                                                                                                                                                                                      SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                                                                                                                                                                                                      SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                                                                                                                                                                                                      SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\jquery-ui.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2363)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):36780
                                                                                                                                                                                                                      Entropy (8bit):5.285425649734029
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:10OW0PLNI85HdOTb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEUw:z5I8RdSb/+vaW1e07nF5fyMhECDS25W
                                                                                                                                                                                                                      MD5:505163E1FD8778CDEC401940391F247E
                                                                                                                                                                                                                      SHA1:9B456B5EB491691D00BF416A11A6F138D55F57A5
                                                                                                                                                                                                                      SHA-256:A44FC0FC779DA7F50050C20F425F729862127783851E4D7C14C7611739C43E1F
                                                                                                                                                                                                                      SHA-512:E28B9C3DF796B76AB02BC1CF871B317286E5E2C5C1E381A60CE8D2B81CC0179824F5161ECF812ED33A1692E78A41731CC8A4031F67D7C7D4A7822F4FD82AA681
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CTahoma%2CVerdana%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=ffffff&bgTextureHeader=fine_grain&bgImgOpacityHeader=15&borderColorHeader=d4d1bf&fcHeader=453821&iconColorHeader=b83400&bgColorContent=eceadf&bgTextureContent=fine_grain&bgImgOpacityContent=10&borderColorContent=d9d6c4&fcContent=1f1f1f&iconColorContent=222222&bgColorDefault=f8f7f6&bgTextureDefault=fine_grain&bgImgOpacityDefault=10&borderColorDefault=cbc7bd&fcDefault=654b24&iconColorDefault=b83400&bgColorHover=654b24&bgTextureHover=fine_grain&bgI

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\jquery-ui.min.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (29724)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):31557
                                                                                                                                                                                                                      Entropy (8bit):5.2301095862972256
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:z5I8RdSlcR8lOXHc11evF2XHzkmBGQv+4v6GpqrrSc7nfZBhVk4:K8VXHcE6Hz1BGQLv6GpqrNBha4
                                                                                                                                                                                                                      MD5:477009769654FEE8AC7335A90907F54E
                                                                                                                                                                                                                      SHA1:E533C54D97DC5DC0D24D4BD917A7F08AEF66C876
                                                                                                                                                                                                                      SHA-256:E3B11AEBD7510C45AEBB9BE978D021B86789C55866FAFA75786147EDD5B9B77E
                                                                                                                                                                                                                      SHA-512:D170673AF46C6A34A6F1B9E4FF57C5D4289FD0672E0392F65D0023E0AF61DD940F0EC46742E298BDDA96AF3FC3744B2FAB6E33A8E791DF86BE984CC6A2444684
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CTahoma%2CVerdana%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=ffffff&bgTextureHeader=fine_grain&bgImgOpacityHeader=15&borderColorHeader=d4d1bf&fcHeader=453821&iconColorHeader=b83400&bgColorContent=eceadf&bgTextureContent=fine_grain&bgImgOpacityContent=10&borderColorContent=d9d6c4&fcContent=1f1f1f&iconColorContent=222222&bgColorDefault=f8f7f6&bgTextureDefault=fine_grain&bgImgOpacityDefault=10&borderColorDefault=cbc7bd&fcDefault=654b24&iconColorDefault=b83400&bgColorHover=654b24&bgTextureHover=fine_grain&bgI

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\pepper-grinder\theme.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (1410)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):18126
                                                                                                                                                                                                                      Entropy (8bit):5.0950206722906195
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:XRLNI85HdOrSedRvx/F5fyuoUaOEcIupn04HgmB0iBfT9RhS2wV53skuMaaSQhQS:XR5I8RdmF5fyMhECDS25W
                                                                                                                                                                                                                      MD5:66DFCE3BD59F9B4E02FB34F63B209642
                                                                                                                                                                                                                      SHA1:5326286217E45DE7ED7FED98EE5404C0D740B485
                                                                                                                                                                                                                      SHA-256:72A8BDCC98DFD935809EA7037022AAC9E39B23A43B6E2C8563986B64AC5D231D
                                                                                                                                                                                                                      SHA-512:14C199579958ED774A376BA83ED45F24CC35079D7E28F7AC7BA0A7703875A498DAF261E9990960C0E2C565A56A2ED66C06E33B6122B4C45C33D9E5A30FA9F63C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CTahoma%2CVerdana%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=ffffff&bgTextureHeader=fine_grain&bgImgOpacityHeader=15&borderColorHeader=d4d1bf&fcHeader=453821&iconColorHeader=b83400&bgColorContent=eceadf&bgTextureContent=fine_grain&bgImgOpacityContent=10&borderColorContent=d9d6c4&fcContent=1f1f1f&iconColorContent=222222&bgColorDefault=f8f7f6&bgTextureDefault=fine_grain&bgImgOpacityDefault=10&borderColorDefault=cbc7bd&fcDefault=654b24&iconColorDefault=b83400&bgColorHover=654b24&bgTextureHover=fine_grain&bgImgOpacityHover=65&borderColorHover=654b24&fcHover=ffffff&iconColorHover=ffffff&bgColorActive=eceadf&bgTextureActive=fi

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-bg_glass_75_d0e5f5_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):394
                                                                                                                                                                                                                      Entropy (8bit):6.531973512673736
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7J1r+U9+WT/RtUFoUkxfx8dj8f5B2zS+Em63KEMlOX:krr9+i5tUFw8dAf2zjEmdEMlOX
                                                                                                                                                                                                                      MD5:EB83AEB42FD8D8F74C93B391951BCF44
                                                                                                                                                                                                                      SHA1:80EAEC927C8AFAA6C7E737CFF9B3511B5D1163CA
                                                                                                                                                                                                                      SHA-256:B88090516DF43FC1D344ECD886301DB6A3EF7BB4FED3E0F654D79AADDBBA6F22
                                                                                                                                                                                                                      SHA-512:C93C1DE7F09C51273B5A6D70E55288806BCF4CA373B67238DFC565C211893BFE29C5208568852B113093A32FEC1EEA26F0C6A9D3DCFE17D6D3B98EBFACFFF4D9
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATH..............I3. .l.&.t..+h.D.u....)..9.v.....O..M_..}_U.. ....<...4.FSu.!;Fv...k.....-.\/R.T......r..)...1.r|d..&e....+.V.6..... ..o.'t.+.`...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-bg_glass_85_dfeffc_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):399
                                                                                                                                                                                                                      Entropy (8bit):6.554533150250573
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7J1r+U9+FVMhhYjbXrsCLzS+Em63KEMlOX:krr9+nYEXVLzjEmdEMlOX
                                                                                                                                                                                                                      MD5:A697D8FD8A5ADBDB87FAF8D78A90E755
                                                                                                                                                                                                                      SHA1:382755716BE10E2AEBAE2BD84711861CE687DC58
                                                                                                                                                                                                                      SHA-256:D868C700B7693AAC8374D6C42569AD8FFCCC35A8F16B534EF6EC72886C9EA174
                                                                                                                                                                                                                      SHA-512:661D532794A11ED85E87753FF1252594BBE8A5385D8D55910E0E6E5377B211DFBEE8EEB3ED7F7D105DDC20BCE4C8329D5527F1D13A5E137EE40431D6D85BA81B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATH...!....G..... ......M.a.X..;....v..b4...ZD.....6l...~..Gr.J...q...p..iQp..FeM...#k..lLL [.......}/...N.I...g;.W.l..lb1.7..9M....q......'.l.#...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-bg_glass_95_fef1ec_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):390
                                                                                                                                                                                                                      Entropy (8bit):6.486146272952941
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7J1r+U9+Awk1em+2vEKvEA2zS+Em63KEMlOX:krr9+JAvEJA2zjEmdEMlOX
                                                                                                                                                                                                                      MD5:D699723AF8436EBA22B885328314BD55
                                                                                                                                                                                                                      SHA1:E98D44337839A92BFB993E56837CAAF0E0BD0CF6
                                                                                                                                                                                                                      SHA-256:F3F6CE30DA7D2A7F442379FF3626F3252A67FB874A3F7304B0751AA7157EFAEF
                                                                                                                                                                                                                      SHA-512:0647A00337946FC123B57A842267DEBCDD4CCC34346283CD4B43D2A777E308164991CBE72447F191CFAE424A44CF1AAD9DCEE6B6023214C84CA67D2C8D5149BB
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATH.....a........\!V....J#X.....D}.....f.>....>...P..x...x......q....u...q...f.+..6....[..\.......W.T4r...6:.]V:...,.(....8..y.G-(d...H...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-bg_gloss-wave_55_5c9ccc_500x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5882
                                                                                                                                                                                                                      Entropy (8bit):7.694397536982677
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:fHVCXcDHxneFLdekEyCcsZ8rj/iGyUS6hpYJ/wEl89vw9Xdewx2vVI8n2RKvrogF:PVCixcLzNtlCvUSn1lQgXd3EKWDvV
                                                                                                                                                                                                                      MD5:C56BA853727C57C51AB90B9E27F7F2D3
                                                                                                                                                                                                                      SHA1:4D505484B4A7E3611696C792846BFFAEAFAA8CB0
                                                                                                                                                                                                                      SHA-256:7A405954C99E375B7831162EFABB9D8814913E928F79CE1C5E641AB62EE05B11
                                                                                                                                                                                                                      SHA-512:428746347A051C02D27A7A6CA3CADD9301F90E58C0DD48EBA7F179A4E28AAD12771081959D5DBD14911643078773859B6FA623414B5B327D58BE5077340D4F00
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATx..O.].]..}~..R..Q;."YZQ7..*.H,B.....L...B.(R.......... ..Dd^........t.ph.......#`uSU..,.$......s...|...........3s..../_..s......&.l.........q.....X.........l........6......k..w.....5..;.............`.`.........q.....X.........l........6......k..w.....5..;.............`.`..........qo..v.._O..[/.l_OYHE..Iy...S#..<.:..J...o..J-}\.qy....dVQL.Q....FS9y..k9u.......o,C.}..r..z...}.Q..C....ztz+.wK..r.J.....&...m..+WU..d...[l.}.]...P.....`.<Ge.a'...w...$e.ne.jx}S..w...qrm+...*...s4N....7j..z......%..O-.yy.k.d.h.7...!o.J..r.m;u._)..y.7...[.JF.7"{5.Z...k9..|.......2......`.."..W.......X.T......5..;......0o....l./.c.....BW._._.o'U&.c..jE..|..*.UJO.u]g]I%Gzw..QZW|Hy..[S......j.Y..W..ny......k....G.w....+R.9P.-.+/wy.#:..(.?x.:}..[=......8Y.....[.wA..*//..%K.r%..1.....j..co}....i.o......./._.oAo.....G..<....M*:

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-bg_inset-hard_100_f5f8f9_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):391
                                                                                                                                                                                                                      Entropy (8bit):6.49868315999616
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7WogU9+M8YprWjpErHohKzS+Em63KEMlOX:no19+gijpE00zjEmdEMlOX
                                                                                                                                                                                                                      MD5:EB961B27BE02A26AF523A68D5774AA6B
                                                                                                                                                                                                                      SHA1:711A6C424D8C5F030B20200616D5DE0716BEEC04
                                                                                                                                                                                                                      SHA-256:F6AF17A4397C4302D2AB2FC227B04C185412B7AC1AEFF7E23DF7E42375CADF94
                                                                                                                                                                                                                      SHA-512:5B925A2E924F10003753A12D9BD4BE126BF077FBDACE0591A7450FD2FB500B363549BF05B8E84AE8B1AECB822E70C87170D41446CB6DEA09D8BA12D8F68C6955
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDAT(...!..q......&.h4I7.M0.;.....o#..I...........3_A. =.!.BU.../..i;...)#!a.|..p!...u$........M-.&.....[...........!v.O...h@_hP.V.mu...o6=.9A....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-bg_inset-hard_100_fcfdfd_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):350
                                                                                                                                                                                                                      Entropy (8bit):6.206000010177241
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPeogUyKfp5Em3MFQ3fK3B6tTLpM52zgN+Em6hp/KEMlOZp:6v/7WogU9+C0MtTLJzS+Em63KEMlOX
                                                                                                                                                                                                                      MD5:63B926C3D199D7774678EC2F1CFEB44A
                                                                                                                                                                                                                      SHA1:60483976063220F6BFC4508287E98522312EE277
                                                                                                                                                                                                                      SHA-256:0AE17677A06192D5114347DE45ED6C6F2C3A660C1202AA6EA44E12BFCE7AFE5D
                                                                                                                                                                                                                      SHA-512:7BE4D05ACD6519F4892F63C0D8F31E4AA6DC3DAA0467B9F93F2B3C3653A87C1CFCEFD267BA03A137EB110C7197F526ED8A03C227ACEB06D2F63787708F103AEE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!...bIDAT(...1..0....`.JE... (z....BHm.......u....~..5w}."....^,..bcb.$..A"..H...V.A,npC...xQ!T..ry.D...H{*1...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-icons_217bc0_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.771544173244556
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:tNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:9Hm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:33AEDE1050C87FAF490EE203D3D47699
                                                                                                                                                                                                                      SHA1:3C5BF5F8F2C247D6054BB159A5D917FD8C451C01
                                                                                                                                                                                                                      SHA-256:00D56BB88843D18972E22608E62E879030C321B2DE8891AF2E1D819535570ADE
                                                                                                                                                                                                                      SHA-512:900C386ADBC961DCB12F5505C599506BF4C4D75883FF6FA9C524499F1F839C9033A9DB69EF9F6E876CEAA24F7A9D5865E263BB4828D3C0C68BAA2F0629B7EE02
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{.!{........ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-icons_2e83ff_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.770844676212274
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:aNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:UHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:DB3B908BD060C6F278FDE9E11B3B94E3
                                                                                                                                                                                                                      SHA1:3F4A9C46377EECDE2C1368EF2B963712B8DF5C75
                                                                                                                                                                                                                      SHA-256:CA8FB2EB9A086B0C170EB61317C91138EC06EA0FEF878B8E24D1F50BF6AF2A17
                                                                                                                                                                                                                      SHA-512:9D27F0E66856343254B4C75969B47B3EBACCD95E63981F18472563D95CB85AE3A1A286187F25DA0AF0996E5C783B8807BABC6C7C6698A180175B06C31A949488
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................).:w...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-icons_469bdd_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.772511909269724
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:ENbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:OHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:ED2F2BA37982B5F821D46811A5F79836
                                                                                                                                                                                                                      SHA1:CB5A57E11754974C65747E3617E119CD1F0A31BC
                                                                                                                                                                                                                      SHA-256:4C7B9E02B3795BEAC99A86532240ECD9FFEAB750769B1E7EB3A3B3CCCED57134
                                                                                                                                                                                                                      SHA-512:4C3C10EE9D1A6C0201561548594D673C77919BD9C0435B8655548F280892DDD046FD41A3F12A20DF046E98DF84F5C831EFEA53FCE7FA583FBF76BBC10EA36F54
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEF..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F..F....c....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-icons_6da8d5_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.7780236195661985
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:jrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrX:jrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrX
                                                                                                                                                                                                                      MD5:72019F22CBCF7555F4BC97AA383F164F
                                                                                                                                                                                                                      SHA1:E26300462491C199D854B4F60E123D2091111FFA
                                                                                                                                                                                                                      SHA-256:A3C75E0F64A223773AD58FA87037A924F12C179394FDBFA1754EF38D50976F42
                                                                                                                                                                                                                      SHA-512:DA05D87F8F767A983953A235AE33C3A4097BC8E3626E18FD4C145A3D6902FCBAE6AB3B6EFA925EAC8932F29176763A9F602552950250BF4878A3B50B2A889251
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEm..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..m..z.6....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-icons_cd0a0a_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.739814671431308
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:ONbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:AHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:A6A39C47239FCDBBE6E1D5BFAA7ADAC3
                                                                                                                                                                                                                      SHA1:E01C6ED29C81AD21B84D0B96427976474D77F21C
                                                                                                                                                                                                                      SHA-256:90044CC699BA3148B8F8777CF7BA69CDB63187582370AE49E3412E00056E05CB
                                                                                                                                                                                                                      SHA-512:48F691B2480F302B2064417FEEF9E28ADB28367FF2CAA549F351DD014F63A75D70AED68B546851371BEC822D7CB037CC644C6AAC1D5C2BC3B6C94E07F00CB87D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..............................................................................................................................................................................................................................................................................................................J....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-icons_d8e7f3_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.773667817462664
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:3NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:vHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:06F311C437236B376B247382BF815C71
                                                                                                                                                                                                                      SHA1:110DB3851E725E1CD30D73D292201A6699344E4F
                                                                                                                                                                                                                      SHA-256:061647E5266E0E229DEAC8AAA16D839EE64DA5C0E7B972948DAC3D071D27F547
                                                                                                                                                                                                                      SHA-512:C90F60977BCEBDA00CE1D77748A3E2C4F53D9526B867537143D3137E4134858F2C02D45F5521699EE0EAFF6AE4D54C4217714D75E902D89D45EB8826ED51D7A0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................e....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\images\ui-icons_f9bd01_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.755062961745714
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:ONbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:AHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:C34E7954FB08D6D72348B49032DC4876
                                                                                                                                                                                                                      SHA1:520468AC13D56C1F347A16DB73003C414C102F56
                                                                                                                                                                                                                      SHA-256:AACA89AA0E8E287A167FBE6108876C274643080BE32C4A33BDED73BC8F970111
                                                                                                                                                                                                                      SHA-512:E3DE7AC662DB301C7621AB4D428EDA5398B273D57DF43B449ADECDE1B24ED0171DD6226BACB25C7DAA248533EA2D88F9342B5330F2A8AAB1006662A8EB447A38
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE...............................................................................................................................................................................................................................................................................................................-...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\jquery-ui.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2363)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):36609
                                                                                                                                                                                                                      Entropy (8bit):5.277735665991303
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:6NAnb/+vaW1e07DVsF5fy6EsDS25Vc6Kvlak:SAbGP7DVQDS2vc6Kr
                                                                                                                                                                                                                      MD5:F9C03B772B04F821D5DF95A7E978F0FA
                                                                                                                                                                                                                      SHA1:78369FFE698A3B97519C2F68E71AB49961957993
                                                                                                                                                                                                                      SHA-256:CD48C6B94CA9ED82E69CE5497D66C68E48C2E40C9874D5618B5EDD940759CB21
                                                                                                                                                                                                                      SHA-512:1BA64B0EEA23BE046EB6C475878ECD5ACC19F8A1DAE70471BE5C0C65D4E3F078B2A741676A61B5F60FE6FF432D71D2F579EA2B6C8D325F0B89B524E17A011D4D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=gloss_wave&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=inset_hard&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=glass&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=glass&bgImgOpacityHo

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\jquery-ui.min.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (29596)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):31389
                                                                                                                                                                                                                      Entropy (8bit):5.222039123586008
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:6NAnlcR8lOXHc11evnPzkpmX+4M6GwXKJSc7nfZBhVBWGc:SAOXHcEnPzkkDM6GwXK3BhQ
                                                                                                                                                                                                                      MD5:33AA343026B23D274B73B0696D159167
                                                                                                                                                                                                                      SHA1:6969B39C578EBFE70C5EDEF7572BC2468AE415D0
                                                                                                                                                                                                                      SHA-256:A578F0FB1E1D3A84D98110663C3FE294415C7118F6739EEB65A623F40F6446B4
                                                                                                                                                                                                                      SHA-512:7BB4728EF22EA1B60A4C56FF1B187C9322686C1648F4730361A1315E4C4597C9BDC7A13FFB3E3A9F1FF7F2A5452F7D368B9C815DC4A7D42A5C10B6FD515D6144
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=gloss_wave&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=inset_hard&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=glass&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=glass&bgImgOpacityHo

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\redmond\theme.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (1370)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):17955
                                                                                                                                                                                                                      Entropy (8bit):5.081854892281221
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:XYNAHB4LCVrwF5fyJ/cEczYq05NQgmB0iBfT9RhS2wV53skuMaaSQhQz0iIhqc6G:XYNAdVsF5fy6EsDS25Vc6Kvlak
                                                                                                                                                                                                                      MD5:D641C1A55384E6F0B0D8137916F7113E
                                                                                                                                                                                                                      SHA1:9493284C7A649EDE21D6E806EFB0337782433047
                                                                                                                                                                                                                      SHA-256:E5E4ACEAF8F1C37A5CB9038C98816C7E3CE03940EF873E2B4AD087AE71D23B7F
                                                                                                                                                                                                                      SHA-512:BAC8933AB878C62592BA734ACAF88AF297B5FB99195716068C6A180F26DA73B37316B318B4F362F830EC7F8818126E4A4B70552498F374B6CF6C127EBBDB0111
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Lucida%20Grande%2CLucida%20Sans%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=gloss_wave&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=inset_hard&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=glass&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=glass&bgImgOpacityHover=75&borderColorHover=79b7e7&fcHover=1d5987&iconColorHover=217bc0&bgColorActive=f5f8f9&bgTextureActive=inset_hard&bg

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\images\ui-bg_glass_55_fbf9ee_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):393
                                                                                                                                                                                                                      Entropy (8bit):6.51579365852352
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7J1r+U9+JgR8nBtx4xzS+Em63KEMlOX:krr9+QwGzjEmdEMlOX
                                                                                                                                                                                                                      MD5:DAAED3CF88E742A2D3820B4C8C55F3DE
                                                                                                                                                                                                                      SHA1:00A345857359FC294C80A28E8662408C31BA602D
                                                                                                                                                                                                                      SHA-256:20FDC83C863EBC3F9B0BF34A4B6FB7FEE55A2E03B77B6303D8D000028525B79B
                                                                                                                                                                                                                      SHA-512:900C94334A4651E808EE6BAEA22901636D44B2B70A0992BC7D6AE733D316EEAE69F857CFAF665CC1F10B76069A25C3DBC3FB6FFE120FEAD1E8BB8893C10E998C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATH...!..A.....b.l.....A.1{..V.Y0i..x...x..v......D.K_..O..9....a......}..^..Ja..0b.vBA.$.,.Q..."_44....=.Sqc..yE..I..W..<kA....i.0....<a$S..y....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\images\ui-bg_glass_65_ffffff_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 1-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):265
                                                                                                                                                                                                                      Entropy (8bit):5.620668247500632
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPh3EUyKO0kIojl2XIzgN+Em6hp/KEMlOZp:6v/7J0U0SXIzS+Em63KEMlOX
                                                                                                                                                                                                                      MD5:ED31481B45167E6F49FDCB1499911BF3
                                                                                                                                                                                                                      SHA1:4C129F32CABDF52B0EAE217A30360C3571390986
                                                                                                                                                                                                                      SHA-256:15470C38D6F3194815FFCB9CB182EE4AED0C4E0839B7B5AB0A5FC1C6ECB67C63
                                                                                                                                                                                                                      SHA-512:7C0199CF2FFB71B0CD5348E7171AC0E2263EBBB92EC8F4C8C659EDA552FAF1B0A34B3263DE0F044360F50E86DDB3CEA23F5CE1C63AC2C514789C58399397A0F2
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............G#7v....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME....."....!....IDAT(.ch`...p....h...4.i...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\images\ui-bg_glass_75_dadada_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):323
                                                                                                                                                                                                                      Entropy (8bit):5.9920009116983115
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPh8TUyKOkMtu+UpQ7YjbIzgN+Em6hp/KEMlOZp:6v/7JSUM7bsIzS+Em63KEMlOX
                                                                                                                                                                                                                      MD5:9B9F1106E912005670402C03BF82F170
                                                                                                                                                                                                                      SHA1:8B7728C1588050612D7B3F58FA864620968F0C9F
                                                                                                                                                                                                                      SHA-256:00EB8C3EA9655DA88F6AC78D327FC9AE95F56C5503BF21BC6510C14BE77955FA
                                                                                                                                                                                                                      SHA-512:F0606E260C42AD909CDBDAFE1E86A4D2F0876980CCD4F20DC8145314021CAAF23945B38569C3FE90C835B02E9FC21BA73C6B817427B86DADB408538CD9978361
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR................D....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."....!...KIDAT8.cx....a.."*....n{11.ab.gb4a....)....&.v......11.01.01.fb\.. 3...EC...... _>o....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\images\ui-bg_glass_75_e6e6e6_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):324
                                                                                                                                                                                                                      Entropy (8bit):6.098454715199907
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPh8TUyKOkMkp5RqM5TC2szKMvzgN+Em6hp/KEMlOZp:6v/7JSUTpDfYyUzS+Em63KEMlOX
                                                                                                                                                                                                                      MD5:DDD65FFF8A75A609B421B4E3237EF807
                                                                                                                                                                                                                      SHA1:726880A9486CF2D048BFAE5EB03C02EB10610B85
                                                                                                                                                                                                                      SHA-256:0756E317C0F7C8B82C40B80E24BB62654E36E8CEFBF2666837765C055443B232
                                                                                                                                                                                                                      SHA-512:EA5CD6266C09D1149417DFABF10D4CF60F3C6F12B13D8EAEF7CA76C5A5DC191D407D3AD271D60F7B9E1784704E045DEAD1E5A447E471938DD2F82C573D608A2A
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR................D....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."....!...LIDAT8.cx....0.F.u..g.....ab...x...+..7&F.&FN&.oL._...3|dfbX..I..Ax..<......0.:.. ....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\images\ui-bg_glass_95_fef1ec_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):390
                                                                                                                                                                                                                      Entropy (8bit):6.486146272952941
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7J1r+U9+Awk1em+2vEKvEA2zS+Em63KEMlOX:krr9+JAvEJA2zjEmdEMlOX
                                                                                                                                                                                                                      MD5:D699723AF8436EBA22B885328314BD55
                                                                                                                                                                                                                      SHA1:E98D44337839A92BFB993E56837CAAF0E0BD0CF6
                                                                                                                                                                                                                      SHA-256:F3F6CE30DA7D2A7F442379FF3626F3252A67FB874A3F7304B0751AA7157EFAEF
                                                                                                                                                                                                                      SHA-512:0647A00337946FC123B57A842267DEBCDD4CCC34346283CD4B43D2A777E308164991CBE72447F191CFAE424A44CF1AAD9DCEE6B6023214C84CA67D2C8D5149BB
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATH.....a........\!V....J#X.....D}.....f.>....>...P..x...x......q....u...q...f.+..6....[..\.......W.T4r...6:.]V:...,.(....8..y.G-(d...H...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\images\ui-bg_highlight-soft_75_cccccc_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):325
                                                                                                                                                                                                                      Entropy (8bit):6.170136138042224
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPedUyKOk3S3OKjr09zgN+Em6hp/KEMlOZp:6v/7WdU3zS+Em63KEMlOX
                                                                                                                                                                                                                      MD5:5E93533BF9087857A8369C2D27467633
                                                                                                                                                                                                                      SHA1:AD5B492E37E840A22A369631DE394245159CC6F2
                                                                                                                                                                                                                      SHA-256:B8F77242E550E590386C19F50E0F15F6615ACE7AE557AE5048FF56F8937A7B2B
                                                                                                                                                                                                                      SHA-512:6263DA0A73674599C94E10D0E01898D8C6F07DBB6297F9AC20009E9D9A94202BE13B4B1737FF7A2E45F1B8603B13D57EEB5DA4E861DA28E831C932729E313D34
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."....!...MIDAT.....@......n.jn5.$.@...(...'G...i...D..7\.....;N...p.....-.u.....&........%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\images\ui-icons_222222_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7025
                                                                                                                                                                                                                      Entropy (8bit):7.929805003010536
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:IcH5ZfLGSAsNh7vB1PP0M6hPmBmc8aWkRwP4:xHjLV9b7vbaxNcbdKg
                                                                                                                                                                                                                      MD5:23ACA9C182696DB96FF9EE5BF9601461
                                                                                                                                                                                                                      SHA1:F2FB72129DB2BA61E5E9E572B24D82FB93ACC3F4
                                                                                                                                                                                                                      SHA-256:28D8B65FD4815EBFFB752BEB60B976D22E8BD4004194B8CFDD0E9A14E39814BD
                                                                                                                                                                                                                      SHA-512:F36FE89779D9EEDD2456826125166428824ABD33C999B187F69F976F51A5FAE7A2B286B44C4312B7B920BDBE0F043EBB652723962267489EB0B575EB5179FEC0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD."..b.....tIME.....%...'E...TIDATx..m.%Uy...$.!,h. ,.%..&...@.|I..E.M.r...D.....2;.f.....A^$5...j^.K.@U.....-.wW...D`..|.q..".t>........3}.S...~.9}.<.>..<.yNp..M.)....`...px..h...t%....y.Y...D.^.`..O..r.%`.:.$%...{.....0L.L..?..a|..6.....]A......7P..'@/:.]5JH.&.ay.......2....:.8t..y.....@.....#*'..?..t.;.Yw.m..........{.>|Dg7..\J.{.4..K.......3...t.f.Z...`.7.u7..Y.~f].<.....4m.*..<.%%...{.^.`....FR........l8<...O........h8<...O..........k.2..n..6cL...`>.]=u........$....,`.&.+h..k.6..J_*|.K.0...?@..lx..do..m.]..L.3...0.;......T.E,;...4......t...MO...mP.L..U.A&......e...+..`...8u...].5.7.7.~"....h8<...O........h8<.....]..C8.Y..s....Z..}i.A. ...).s.W...!.m.........z.[.#...R.....\R..{...v..........r.....R.. .?.#..[.|.f....`.........y...).A...-..Q.N..4w....:Kr{.......3...Z.P.!0t.{l.\.Y..wSn.P.IA..Vm..-.R...$y.....sI....@;..e.X...v......Y.v...B....n]g.......W..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\images\ui-icons_2e83ff_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.770844676212274
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:aNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:UHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:DB3B908BD060C6F278FDE9E11B3B94E3
                                                                                                                                                                                                                      SHA1:3F4A9C46377EECDE2C1368EF2B963712B8DF5C75
                                                                                                                                                                                                                      SHA-256:CA8FB2EB9A086B0C170EB61317C91138EC06EA0FEF878B8E24D1F50BF6AF2A17
                                                                                                                                                                                                                      SHA-512:9D27F0E66856343254B4C75969B47B3EBACCD95E63981F18472563D95CB85AE3A1A286187F25DA0AF0996E5C783B8807BABC6C7C6698A180175B06C31A949488
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................).:w...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\images\ui-icons_454545_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7090
                                                                                                                                                                                                                      Entropy (8bit):7.925434318681863
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:Tbhz1Ogz+PpLVLuOyc3AJzX/7N/dlbNPtGzQ4gGdBcFk3v4Ql+p23elLTJVaXKkH:NQ3tIOj6/dtFRCMmgo+p/Z9UFAhKDsHW
                                                                                                                                                                                                                      MD5:5C3BA680CC34CD9B30855C180474A152
                                                                                                                                                                                                                      SHA1:91FFCF4A399238C121F42951BA801E7C5030C1DA
                                                                                                                                                                                                                      SHA-256:33EEDA3A7ACEAC3E727FCA686F18E8736824ED4A1FCE72B8952F01EB2356CD77
                                                                                                                                                                                                                      SHA-512:4FD4B8000F8059C5CA9484A3B61EA10C1323110336D924983D3473F489A4FE7E417DB2AF4E02433BFE017831E6B80CC427C00531EACC55BFE6D2501CD2686269
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.E.;.-....tIME.....%...'E....IDATx..k.%Gu..m;....!.^...p.l.0..[..HX..H...:w...8;.........g1s.....].&..<...............C.lfq..!,."....Wu...{.v.Gwn.>U.UuN=..S..x4.g.:...........6!.Agb3.. .6+.J.D...0...&..s..N..._..B..s..&.&..>~.=...c{v..j%.._.D......Y..E...F.q...G..........R.S.C....E...!..'..NP)~..t.=;..w.me.BH{.s...S......&..S..6MCP6.z..!(..hnE.6.Vj.cO..6.y7..i.~fK.......j.T.0....<.2.......6+..^;..4.~%.....px.h8..4.^.../............:...2..n..6eL.h.`~..=u....p.....r..n.0s....Os.....Wr...G...h. ._..C..mz.-..=.)w....Fi..#...@u-c..P...O.{.S.s.^|B..A.'m.TQ.....n.`..[.......|....t.7.^..p......@........px.h8..4.^...s....C8.U..k....N..}..A. ..*..s.%......~...a.JYT}.-....1..pT..V..P%.%...?p(.>~.PA.E..........]..1.^.....(...[#....\....WR..>4j"m.h...I.@I.>]...y.........A6...........E:..q7.......n..05A...uP..y.L.8.Pj....K.9.[...E.Z............L...u.....L....;X

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\images\ui-icons_888888_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7111
                                                                                                                                                                                                                      Entropy (8bit):7.928604829942714
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:O+057dZiVq1IWkYLeDEdEsyyL47BhYk6aNCdjh4:O+0pWVljYLREsyyoA6CdjS
                                                                                                                                                                                                                      MD5:CF9C28612E00F36E9C312DA7689AB3B0
                                                                                                                                                                                                                      SHA1:4D8D263100EDC2B443EF6C7118417126DC6CEEC8
                                                                                                                                                                                                                      SHA-256:A046793EDDD1EB9087A6118ED0ED442FE8E1FA4BC4DEE13CDBA2029FBCA010AC
                                                                                                                                                                                                                      SHA-512:B2B4DB53A81CA36E36D64CCE853F74B0814BF34C8D3807EDEDF84CE4A2EBE9613C335874F1011773F305345E58A0EA1F1DC15559A7DC5B0286A14694EF7F3942
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..I.( ....tIME.....%...'E....IDATx..{.eE}.?.H(bX.!..[R.`....J.H..!w..M.b...F...h...............XT.#.D.T.;"ba.Rqw}.......G...)b.....}N..9..sO....s..Ow.~.8......<..3.......@...@F....3.... .....$........+.\.....$...................Ook...0.Z."..."`Jy...Q.z...B.7i..Q'...........q.....I..v.C.......T...2..m..k..5e[.7............G.t....k..!HL.^?3d.J...[...f.Z...S0.Ms..}`.....T8.t....US...........@1.a...`..fe..k......6.^.../........@........px{.|.A...Q...."...i....O....=.]...}....=....\.z...\..mc.-...>....(..D..'.L.6=.......;........l.............=.....M/>....6..(.....0.......$%.GI_.km..+.$..q.....W.7.~!.....px.h8..4.^.../.........QG8.U..k....V..}..A. ..*..s.%......~...a.JYT}.-....c*v......J.=C.`+~.P.}....\....=....4...3.....%4.Ph...F,._..\....WR..>4j"m.h...i.@I...zJ..y..ts.Y...@.e.e'..C.r..jm...C.&...[..LM.%m{...e^....%..f....lN...u..d{..$.*."n.K9(...u..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\images\ui-icons_cd0a0a_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.739814671431308
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:ONbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:AHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:A6A39C47239FCDBBE6E1D5BFAA7ADAC3
                                                                                                                                                                                                                      SHA1:E01C6ED29C81AD21B84D0B96427976474D77F21C
                                                                                                                                                                                                                      SHA-256:90044CC699BA3148B8F8777CF7BA69CDB63187582370AE49E3412E00056E05CB
                                                                                                                                                                                                                      SHA-512:48F691B2480F302B2064417FEEF9E28ADB28367FF2CAA549F351DD014F63A75D70AED68B546851371BEC822D7CB037CC644C6AAC1D5C2BC3B6C94E07F00CB87D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..............................................................................................................................................................................................................................................................................................................J....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\jquery-ui.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2363)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):36536
                                                                                                                                                                                                                      Entropy (8bit):5.275194338840845
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:10OW0QYpynb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURH4N/z:EYpynb/+vaW1e071F5fyBErDS25ulak
                                                                                                                                                                                                                      MD5:BF051F24690699BC2665EF6E4D7487A7
                                                                                                                                                                                                                      SHA1:0A5599C5783E60B7D51E928812039F3F5C74666A
                                                                                                                                                                                                                      SHA-256:F9B751C1CD0D2B0F91862DB987FED9DDA48758B15E6F42CA67796B45F4B21702
                                                                                                                                                                                                                      SHA-512:B0E0B50B753FECBE36028D7EFA3C150A99E59616F19DF0F9DB9241644DA1D7E7189CB8376881371B544158A4ABFFD705E4BC41D42C4F72402F1EACF3ECEE1AA5
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=highlight_soft&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=glass&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=glass&bgImgOpacityHover=75&borderColorHover=9

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\jquery-ui.min.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (29523)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):31286
                                                                                                                                                                                                                      Entropy (8bit):5.218372761012579
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:EYpynlcR8lOXHc11evnpz5mG+4e6GYEKlSc7nfZBhVFWGc:E4yOXHcEnpzUee6GYEKDBhM
                                                                                                                                                                                                                      MD5:3C2A865C832A1322285C55C6ED99ABB2
                                                                                                                                                                                                                      SHA1:B456F4C43E3D45F0A85811E2C60B2256DFD2EFDB
                                                                                                                                                                                                                      SHA-256:BE92933B839BD4CE1B67C440BD9BD832D8A7333D578C7D1061D00EDBCEB557D3
                                                                                                                                                                                                                      SHA-512:FB45616EEF2C454960F91FCD2A04EFEDA84CFACCCF0C5D741BA2793DC1DBD6D3AB01AAAE6485222945774C7D7A9A2E9FB87E0D8EF1EA96893AA6906147A371BB
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=highlight_soft&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=glass&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=glass&bgImgOpacityHover=75&borderColorHover=9

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\smoothness\theme.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (1340)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):17882
                                                                                                                                                                                                                      Entropy (8bit):5.072830940698532
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:X2YpyqN/tNwF5fy2+kXcEcINyB5NYgmB0iBfT9RhS2wV53skuMaaSQhQz0iIhdlR:X2Ypy/F5fyBErDS25ulak
                                                                                                                                                                                                                      MD5:E4327912458100FAA111DBE7BD75F4D9
                                                                                                                                                                                                                      SHA1:A2566EEB6FE07C3C1ED420E7847D92447457EF55
                                                                                                                                                                                                                      SHA-256:EFA52E8C5D9D6B5E4F28174788304FEC2F279A52B999BA6B806AC852A12A5509
                                                                                                                                                                                                                      SHA-512:A2A62110A5F170AF0225E3695A5E41CB56997C0E361931751996FB0182CAAA08C201983105978DD2D88608FD8354607351751832D8F3746FFDCD715620578734
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=cccccc&bgTextureHeader=highlight_soft&bgImgOpacityHeader=75&borderColorHeader=aaaaaa&fcHeader=222222&iconColorHeader=222222&bgColorContent=ffffff&bgTextureContent=flat&bgImgOpacityContent=75&borderColorContent=aaaaaa&fcContent=222222&iconColorContent=222222&bgColorDefault=e6e6e6&bgTextureDefault=glass&bgImgOpacityDefault=75&borderColorDefault=d3d3d3&fcDefault=555555&iconColorDefault=888888&bgColorHover=dadada&bgTextureHover=glass&bgImgOpacityHover=75&borderColorHover=999999&fcHover=212121&iconColorHover=454545&bgColorActive=ffffff&bgTextureActive=glass&bgImgOpacityActive=65&borderColo

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-bg_glass_55_fcf0ba_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):391
                                                                                                                                                                                                                      Entropy (8bit):6.55690601973133
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7J1r+U9+D0hJkHTx1xwKzS+E3V+2EMiVw9:krr9+ghWxwKzjE82EMr
                                                                                                                                                                                                                      MD5:8BF4A2E7590E3970ACD416CD3316B9FE
                                                                                                                                                                                                                      SHA1:DA0F754D6641364067F95A83C7B65286CD2DE909
                                                                                                                                                                                                                      SHA-256:4D3E42B5EE27F39276D1426A819549865E285CA0018AD323CF526FFD172971E2
                                                                                                                                                                                                                      SHA-512:0022BAAA1E32215DCAA4BC6E3E4DD511979E52EC4C6BD200DFD4B1893006D3FCD6958CD1324AA051F01E6E505CABE28CA6D2AA79D0A8A8E2FB4880E816283819
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDATH.....`....;E...Zv...n..V..5{.^.........6.....h...^8ph..x....q.oC.e..z..........vU.o.1#...Q..vT...."...kS;..&.u...,.).>._.v...!.p....|@j...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-bg_gloss-wave_100_ece8da_500x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5817
                                                                                                                                                                                                                      Entropy (8bit):7.684670763456218
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:fHjNcCWhpgKcYa69MWkATL587NYTv8B+C4CS2fzwIznpHDHIawkGfUin7G:Pj1Wjg0a69ZASTv8BAwPzZHyUAy
                                                                                                                                                                                                                      MD5:B48C85BA6D9BD33B52AF8D73E3374E8C
                                                                                                                                                                                                                      SHA1:EE2D179E2EF219D3BA8AB8EE8501EE5B803D6552
                                                                                                                                                                                                                      SHA-256:C230D01C2F651EA4CDC8FE31984948905B5561DA9EB8C2E0DA02A3BDAC1EEFC9
                                                                                                                                                                                                                      SHA-512:D3F2EB8012B14CC9FBD1EC1BF3B55C9BA6B53025D775C71CE83CB05DEA3FE0835D64424DFA53A1CB704424A68E0B0EFE64900C9B5EE37318F69A1BB4BD74DDD1
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDATx..K.^.U.......1.A.....A.ZG...A"f......h.....{@.......w....".!..U........4...o.P....n...R$...=..{....|.s~..ss..k.._k..{.._.r|.r.........j........q.....X.........l........6......k..w.....5..;.............`.`.........q.....X.........l........6......k..w.....5..;.............`.`.........j..v..-...Sm..K,..S.RQ..<T..7z.b^.l.%...Ds..>/....z.U2.(..gS....TN.,.ZN..V..W......WF)..g.\.W.%/.5DQ...Z.-.&.+P.g^.{.5y...l...X..J,%..<b|..<...........$xn.Y..p~..9P..5{....M92>;..O.k[.q_.2JK;G...~.Y...;.u^..K..A.Z6..7z../.<o...C.....r.m;u..)..y.[W.L.].Jf.7".j.....x|..{....L......EX..........'.U.....`.`........,.e..[q3..G.'....}.a.a..T......(....<.RZ...G.u.Tr.....2..C..>.5.N.\..WK.....}...W..K.7O.?z...n-..HYS.@.Z.+/wy.3z...Q^=x.:.z.w...c-...d.K.khA......x..,..d6/..J...u....>.6.....v.V.H..a.!..C.....e..q.).S..:....S<..F

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-bg_highlight-hard_100_f5f3e5_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):394
                                                                                                                                                                                                                      Entropy (8bit):6.418949384814716
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7WogU9+DRCLwIBRzQ67pPJgzS+E3V+2EMiVw9:no19+QdBxQSphgzjE82EMr
                                                                                                                                                                                                                      MD5:5AD852FBFDC1BEF56FD9FA29D82337E3
                                                                                                                                                                                                                      SHA1:8E93097664FB53F9CCC19C5ADDFDDCBB1E81279E
                                                                                                                                                                                                                      SHA-256:29A7A7B7A0506713D11B755F68836DA0905AB86CD0A3D65B5CA8CF81F0F72A1A
                                                                                                                                                                                                                      SHA-512:99844BC6AAA0132DFE2299FAB33A4A679C67EA2DF94FD132194756326115C72255B302C4C90DC71ADE0DA5D96DEEB948DC2C6D63ADA5FEA12BF799E2566973AB
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(.c......>&......Q.......3..[~..r..a...."..^.|..4.C;C....?.......g...w..~..^....G..o8......j+.C.............a........~Q~.......O...7.....BB..o.p...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-bg_highlight-hard_100_fafaf4_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):379
                                                                                                                                                                                                                      Entropy (8bit):6.402477277052991
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPeogUyKfp5EWqiXm2DIHeZttpEx5wMI5zgN+E3VKF2EMiVAVTp:6v/7WogU9+mXmL+Ttqx5b6zS+E3V+2Ek
                                                                                                                                                                                                                      MD5:F6D7F3181C5D064D2889525322F0E928
                                                                                                                                                                                                                      SHA1:D2F282EF7C8955CE88076A3A757ED984FF1DE59F
                                                                                                                                                                                                                      SHA-256:C448B81DEE17998BEA1596080F0558AAF5680EDD6E7405EDDC951DEFA54C5DBE
                                                                                                                                                                                                                      SHA-512:4E84F814F417993A5EACD47465915D7A1CD073BA88FB0917B50DC5408E497220EB87F2833DCDD6013636641F66A5A5BCC926E1C98A2CF250C5DEB62BAB2EF665
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(.....P...?7.3P2..8..0.....k.P...5..@LX.|...8..1....ww.......l..L.&..&D".^{.?.di?a....00.`.U...<]..Z!..N......[I.9..?....;.qT|....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-bg_highlight-hard_15_459e00_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):380
                                                                                                                                                                                                                      Entropy (8bit):6.430777033274858
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPeogUyKfp5EBsSO3WopfvcMeGGrxD2CJzgN+E3VKF2EMiVAVTp:6v/7WogU9+/O9pXcMeGGJ2CJzS+E3V+W
                                                                                                                                                                                                                      MD5:FDE0ACA7B0C5540F60408E08EAEDA139
                                                                                                                                                                                                                      SHA1:957FDD70495B752FA260816286AEB1F24E988178
                                                                                                                                                                                                                      SHA-256:A48F5D8887DA20CF63C77E9E00D688EAE209E4C92D01E0D7E3257749B9E0F69C
                                                                                                                                                                                                                      SHA-512:34B2BD05B5ED3B8A28F204481CF136327D055B2EC44693AA1987AEC248DB710857FE19583B4F16681FF621807F08A614266B86C8BF47E12E5D245B780F069305
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(.....P........NP&@A.$.$.L...1C..)P..].f..c.<$......zTX..?............U..fLL....TQ.=e<.;...U$..Frt,.6Om.`LCk.u..;.?..E.:.o.GQ...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-bg_highlight-hard_95_cccccc_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):317
                                                                                                                                                                                                                      Entropy (8bit):5.9481014168776705
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPedUyKOkB6+pLcXb0VDSj2zgN+E3VKF2EMiVAVTp:6v/7WdUtqXWzS+E3V+2EMiVw9
                                                                                                                                                                                                                      MD5:A59F6D7582F1126FD096A883D295AADF
                                                                                                                                                                                                                      SHA1:6E52C2B7763CAFDDBC13CEE0F1DA0E1B5C850145
                                                                                                                                                                                                                      SHA-256:D7208E0189A4C99B0C7DCF585C92397DC22A12699DC9CA5FCE5C04363F761CDF
                                                                                                                                                                                                                      SHA-512:0BAC5EF6895D9DF5E9FFCC80123AA7B325084B960C28187426066503AED7A487BFEE192B997C3F8A30AF38300818CAA63F61B36E59075C85AA19C18E79A5DF6E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".......EIDAT..cx....a..y......c.....6...L.[.n.d...p.0.e.....I0..`.o;..d`b`.....o......%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-bg_highlight-soft_25_67b021_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):411
                                                                                                                                                                                                                      Entropy (8bit):6.622951677016995
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7WogU9+G4VCOw7L090zS+E3V+2EMiVw9:no19+DoOwf090zjE82EMr
                                                                                                                                                                                                                      MD5:916F5242DDC366581A4E27F587414435
                                                                                                                                                                                                                      SHA1:2477511778ABB7FACA494FF07BF5F82912897124
                                                                                                                                                                                                                      SHA-256:925DB451C705BD16B66A084ED9B3656387830131868E5E92A8660DDFD499D7F7
                                                                                                                                                                                                                      SHA-512:03530567A01F90B3DC7E326D9EEAF97622D0A209BBCE89C5FC9EBF53C61020CC2A9DC9EA7278F8CFD1246E32B7678232AB526F10B8212B919AB532ED8645AFC5
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(..!R.P....\....a.|e..@2..4.L.....#+j...RQ......0S..b......ioI...?..d.FVS2r1I..U0...j.L...d...L..Y.#.Eu..LMr,....|...[..d...L...d5.&1.j..3.Wf........._..a7.@._...%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-bg_highlight-soft_95_ffedad_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):409
                                                                                                                                                                                                                      Entropy (8bit):6.56783434179835
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7WogU9+B6lGW5jfTO/Z2zS+E3V+2EMiVw9:no19+wlG6TO/IzjE82EMr
                                                                                                                                                                                                                      MD5:6CFD2E60683A1938A11922AA839984A1
                                                                                                                                                                                                                      SHA1:0AA783ADF35C4A21C3980B0832D4A57AD12CE791
                                                                                                                                                                                                                      SHA-256:7F08CA7830A2468315EAFB1E1E23625A2F9BA3CEB1FE0A17B773A9B2424036CD
                                                                                                                                                                                                                      SHA-512:698832C8E9DD14107F73022D50EE41E8200850832C3E5E5457E3CE39C5BD8F858DE4AC4E9AA5E9A1D1CAD28AD3C2F07233E6AD0BAD1AE4F1C6318DE49EC53FB5
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(..1..p.G_>..f.....q.ghz.J.@g[.Z:X....ER..............!=z.....pf.T...|..u.............C.!.v......dSC*:..).,.Hyc..h..#]....<7B.T..g!r..o9..@.....x.T.T........%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-bg_inset-soft_15_2b2922_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):380
                                                                                                                                                                                                                      Entropy (8bit):6.461070348423757
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPeogUyKfp5EBFmBGSxK2P+YaOsfc6EWU10R9mJ2zgN+E3VKF2EMiVAVTp:6v/7WogU9+A7s2P+IMc6EWU1pJ2zS+Eb
                                                                                                                                                                                                                      MD5:F81024672586DCD00BB1EFE5CE5609CC
                                                                                                                                                                                                                      SHA1:3CA80356A781540FC0E9A168E7E7CE093D7B0567
                                                                                                                                                                                                                      SHA-256:E92AB30319BF5F5D1437C3517CBEB51E3BE4AFAC9A53C304851A2DF3DB0BE253
                                                                                                                                                                                                                      SHA-512:D0A04C41EE7ECC50AFE39417EE45E59CC6661B1B2E3BD7A2EB5CDC09DA664C0876EC18AF31EDB1A87A93BD2922085C73964256F17A0AC49361B2C425DEBC7821
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."........IDAT(....P....1.B.0..9..9...xb......h........$...\t.Mm8.*.F=4...h.o.3r.i%.,Fd.............d...s[.:1....1(.N....V..?v....#r4.g....%tEXtdate:create.2016-09-14T13:34:09-04:00.3e....%tEXtdate:modify.2016-09-14T13:34:09-04:00.n.....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-icons_808080_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7117
                                                                                                                                                                                                                      Entropy (8bit):7.923945259207644
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:Y+Ud8y7auSvSbMkhRFHMcYkFPrj+0YLE1WXE4e:Y+gb/XHMtkBjMn+
                                                                                                                                                                                                                      MD5:FDF6299906487D9970ED37DD84E67250
                                                                                                                                                                                                                      SHA1:49DD01B6D573B340DEA80743DC5F32BAD5CFA1A4
                                                                                                                                                                                                                      SHA-256:C89F549E41DF136A408D650F9517186F62D5418F00955B32667A0DCBED415FBE
                                                                                                                                                                                                                      SHA-512:4DCD2D48B6A4F14EA3CB024FFD4CB90C43B6360A2CD3723A98FEC910244048B394647068640B1F9EBD3A041A073DD2A026E20CF29093BF381E1D7C916359674E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..G5......tIME.....%...'E....IDATx..{.eE}.?.L(bX.1..[R.`...J.H..E.M.b...F...h....P..... ....XT.#.D.T.;"ba.Rqv}.......G...)b.....}N..9..sO....s..Ow.~.8........d.1..x..^.../.2..........m...&.@..`..MX9.2....$)...=.,...0L.L...}.0~z[.....J...%..S.#.G....po....I;,.:q! `.X! 0.\..C...."&.@....#"J'..?ie......k.2n"d=...t.......&..S..6MC..r.~f....0."S..*.j..`n....,e[?.....1l..WM.......+p.....G..Uz..F..Qb..^......px.h8..4.^.../........@.....q....F.{.7...2.m..0?..:..vux.....r..n.0s....Ws.....s...G...h..A....2...t[l.{.S..O..7#..N.G..=..Z.S/..co.......7...Vk.2O.....j.llc.l.`..[...<.%}a.......x...t.7.^..p......@........px.h8..4.^.....CF...W.......E.K%.2..5..UA...(.<..`......+P..3l..X..S..G..n%p.U"..R.[..........R...q._`....P.5`..Y.BKl.5b)....Z|.......t.Q.i.E.. Lc.J..t.S...Ch....Jgn.b..(;...Z.-..tVk.n...R71.%.5`j..i..@/...uq...4s.h.`s....... ..]&.Ua.q;].A.....7

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-icons_847e71_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.776257661253038
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:tNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:9Hm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:0F6217A6D8C5FA6182B2D3B0CE5BA27A
                                                                                                                                                                                                                      SHA1:8E8369E95B0C69B840B823E0C10C98781A1830F9
                                                                                                                                                                                                                      SHA-256:9E5F817E9290D81C7E075704163A57B9F3D8BF68C474F81535AFF71762F4E8F7
                                                                                                                                                                                                                      SHA-512:2C7141DBDCBA9F63EB3AB74D505B773B84220C83C39EA652522C16BE5730F2CC537EA4F29FAC386B85E48FFCA7A04F6135B30E8B364B0B6D58CCF6E902882C08
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.~q.......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-icons_8DC262_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.775872077303001
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:JNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:RHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:AEA745F96521B224FFEFE0B09A2B51D3
                                                                                                                                                                                                                      SHA1:FDCC8D416A78574B8046355B3F6DC59E9F0716D1
                                                                                                                                                                                                                      SHA-256:001DAB314ABC06451A9DB2484608E8F1AF9C37597D66550FF7B04DB531D1CF65
                                                                                                                                                                                                                      SHA-512:0195425A8CA501A9B10046C3E783515063FFC2ED73ED25B42AA5B66CC4C169D1AA7E6B26A5F0D63C3367E78F4BDB795CF4BCE6ADAB61425C970BD793DDB77144
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..b..0....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-icons_cd0a0a_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.739814671431308
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:ONbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:AHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:A6A39C47239FCDBBE6E1D5BFAA7ADAC3
                                                                                                                                                                                                                      SHA1:E01C6ED29C81AD21B84D0B96427976474D77F21C
                                                                                                                                                                                                                      SHA-256:90044CC699BA3148B8F8777CF7BA69CDB63187582370AE49E3412E00056E05CB
                                                                                                                                                                                                                      SHA-512:48F691B2480F302B2064417FEEF9E28ADB28367FF2CAA549F351DD014F63A75D70AED68B546851371BEC822D7CB037CC644C6AAC1D5C2BC3B6C94E07F00CB87D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..............................................................................................................................................................................................................................................................................................................J....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-icons_eeeeee_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7010
                                                                                                                                                                                                                      Entropy (8bit):7.937028775954862
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:alNgJh1aEbYK0aRv2Tt6sqvaZ6t939Teulhv8CVL:aotbbYK0aRvsnFZ6f39Tei88
                                                                                                                                                                                                                      MD5:53E268DFFFD69B4C3A204488A93F331D
                                                                                                                                                                                                                      SHA1:5CB0300B3020FC197603F8AF8F1B0674EA673D84
                                                                                                                                                                                                                      SHA-256:0B71B6FF77D7DE81E242DF3EF02FEEDBEDD52B8642B0DC9EF5BC9E5477414BA1
                                                                                                                                                                                                                      SHA-512:6D587F179A8F01E49CE7B258AAF60207E6B2A1154DBEAEBD68CAD2B905ED54CECACBA0D1D5B311B08CDD893F2AF6E603DE1048D797A498949BE769785469C440
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD...?.M....tIME.....%...'E...EIDATx..m...y..c.Z.....c.......BR)....6.bz.H...I.i.z.w.......P.-...z.6MR,...U.X.b;).n..XCc..8.*.......63..{..W..w.s.9...9.s.....:cE.+..[8....."..4{]...#@.M.:Q......../.s....Q....B$.....?.L..:.....Lc:w..rW...>......#...D...B.Q..>,.*y..c.....\....^<..]bt...C.y....J..2..M..+..d.5.#$=.......4....u*.R....A..3}...L.....I...w.%..M}..}`R...YV(N.=..7M......AQ.......X.h27H.5....p3.5.#@...Ps8.....5.#@...Ps8..l.^...Q....#.d.ij...g0...?.....}.HR......oB...)..mR.............P.G.t.6.....@W;............ ..b....1.6.....nj..Fo."gZ.(c...\...@G.S..].3.k......../1.9..p.A5.#@...Ps8.....5.#@...Ps..........W.+-\..e.J#.......MA.=.rq..Ak......E.s......b&G..vW`..@..B...{.....Y4..%..c.M.<.L.,v.Hbn.......r..&....l/_.cn$......D.F.*5...T.>..,.......N.N...k.A.@...1..ag.{.N..E.:..[..t..M..6....&].M*.L...../....u.;.tv...0S.,.jP....:.=.z..L...i

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\images\ui-icons_ffffff_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):6487
                                                                                                                                                                                                                      Entropy (8bit):7.90376532755891
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                                                                                                                                                                                                      MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                                                                                                                                                                                                      SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                                                                                                                                                                                                      SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                                                                                                                                                                                                      SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\jquery-ui.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2363)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):36786
                                                                                                                                                                                                                      Entropy (8bit):5.282160205211848
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:10OW0sRdX0Zb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHC76:ydeb/+vaW1e07PddF5fyfEvDS25/
                                                                                                                                                                                                                      MD5:5F3CE6A81EE8FE565088287F643091F8
                                                                                                                                                                                                                      SHA1:FC9505428703E02CDEDCADA79F4812EB27E1F257
                                                                                                                                                                                                                      SHA-256:8C736B0D1F47B29FA98FC10CC4F2F07543441E9F23E987B1484C7146635AB17F
                                                                                                                                                                                                                      SHA-512:73576139BB8D465F1D25676ACF9843DAF4E07C82F0C96A185F57638D22BA8ADFC8DA2F0C6BA4625C4C160A2FE93CA9D3F2B598A5F8B37D00011B64680B89F291
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=segoe%20ui%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=ece8da&bgTextureHeader=gloss_wave&bgImgOpacityHeader=100&borderColorHeader=d4ccb0&fcHeader=433f38&iconColorHeader=847e71&bgColorContent=f5f3e5&bgTextureContent=highlight_hard&bgImgOpacityContent=100&borderColorContent=dfd9c3&fcContent=312e25&iconColorContent=808080&bgColorDefault=459e00&bgTextureDefault=highlight_hard&bgImgOpacityDefault=15&borderColorDefault=327E04&fcDefault=ffffff&iconColorDefault=eeeeee&bgColorHover=67b021&bgTextureHover=highlight_soft&bgImgOpacity

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\jquery-ui.min.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (29738)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):31569
                                                                                                                                                                                                                      Entropy (8bit):5.226827075703083
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:ydelcR8lOXHc11evx0zkmc+4i6GpaD/Sc7nfZBhVE:2XHcEx0z14i6GpaDRBhW
                                                                                                                                                                                                                      MD5:214251BCC995B04AB7591B5A91F3D613
                                                                                                                                                                                                                      SHA1:CF0BDD7C7A728BA85F0D09B3CBB32E63DDDEBA24
                                                                                                                                                                                                                      SHA-256:FFCC4681C57A329F5F15ADAEDA52D839660D96E09DAC712F05F8B0869903FC9B
                                                                                                                                                                                                                      SHA-512:EA793B66A6F7170DC52325FAD5A2834A7AECD2BFCC69F98F053666536A4AC2413AE9945EB758B96C4F6C7B88FE3E73CE85A836ED3EAD407C54A7BA21F91785BF
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=segoe%20ui%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=ece8da&bgTextureHeader=gloss_wave&bgImgOpacityHeader=100&borderColorHeader=d4ccb0&fcHeader=433f38&iconColorHeader=847e71&bgColorContent=f5f3e5&bgTextureContent=highlight_hard&bgImgOpacityContent=100&borderColorContent=dfd9c3&fcContent=312e25&iconColorContent=808080&bgColorDefault=459e00&bgTextureDefault=highlight_hard&bgImgOpacityDefault=15&borderColorDefault=327E04&fcDefault=ffffff&iconColorDefault=eeeeee&bgColorHover=67b021&bgTextureHover=highlight_soft&bgImgOpacity

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\south-street\theme.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (1408)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):18132
                                                                                                                                                                                                                      Entropy (8bit):5.089714022844099
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:XmRdX0i77gndVjE5YF5fy2RCcNeeqEcY9pn0NygmB0iBfT9RhS2wV53skuMaaSQm:XEdAddF5fyfEvDS25/
                                                                                                                                                                                                                      MD5:7E69CD2743CA2896690D9FBB1E119318
                                                                                                                                                                                                                      SHA1:CBA6CA6BA67596D14070FD4EBAD98F2B3DCEC4A5
                                                                                                                                                                                                                      SHA-256:319040E0E34436F99396573380A1BC08955AFFED065F37A49FAFC9E72F240CF0
                                                                                                                                                                                                                      SHA-512:9A2F7535D8B664D9A3B5FDDAEA9965503B43648544C498A17AECD5D1103149F6FFD06CEB51BC5E649C002CD2890D43AA4F51FE6D5B744313F3E958A329D8D0C6
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=segoe%20ui%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=ece8da&bgTextureHeader=gloss_wave&bgImgOpacityHeader=100&borderColorHeader=d4ccb0&fcHeader=433f38&iconColorHeader=847e71&bgColorContent=f5f3e5&bgTextureContent=highlight_hard&bgImgOpacityContent=100&borderColorContent=dfd9c3&fcContent=312e25&iconColorContent=808080&bgColorDefault=459e00&bgTextureDefault=highlight_hard&bgImgOpacityDefault=15&borderColorDefault=327E04&fcDefault=ffffff&iconColorDefault=eeeeee&bgColorHover=67b021&bgTextureHover=highlight_soft&bgImgOpacityHover=25&borderColorHover=327E04&fcHover=ffffff&iconColorHover=ffffff&bgColorActive=fafaf4&bgTextureActive=highlight_h

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-bg_glass_45_0078ae_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):403
                                                                                                                                                                                                                      Entropy (8bit):6.549410477715596
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7J1r+U9+YLvWMP4m/a1sPzS+Em63KEMlOX:krr9+YLvWL31sPzjEmdEMlOX
                                                                                                                                                                                                                      MD5:05B4189C61CAD5711E124518CB55D11E
                                                                                                                                                                                                                      SHA1:B4CA6A3F981478FBEA4D1E40EB8F0F5BA5B2FA5F
                                                                                                                                                                                                                      SHA-256:59CEBFCF759B6B7ED33FD4CE165223F8895C090CD2D943F11D6F582E50FEF05C
                                                                                                                                                                                                                      SHA-512:0D820891E083DE8A41C3D0CF5797D6D3015613F43C1F401AE53C7B69F47D99B1FE019213A275469760E18029B4E2DACF4AECA7B4E34D5EA55A8D503CE3AE66A5
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATH.c...pwo .......(5J.R..(Es....?.21.g..8..E.I...+.....L.?..1Mab{.,.t...>...]&.`.H&&&.`.H&f..]..=&.....;.X.0/d..."......1....c1.......(5J.R...Q...#........%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-bg_glass_55_f8da4e_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):403
                                                                                                                                                                                                                      Entropy (8bit):6.460562824701208
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7J1r+U9+Y0gs2gttFr59GnHPvlKiavzS+Em63KEMlOX:krr9+Y0gs2Kh96havzjEmdEMlOX
                                                                                                                                                                                                                      MD5:67E15B90051B76936D9FE904E4B1B972
                                                                                                                                                                                                                      SHA1:D66C7D1C33D1CB0DAA6B3D0F79592D63818BCD24
                                                                                                                                                                                                                      SHA-256:4E393510798CBCC6746684F6C0092651FB59AB9922C475D91F4C50C92A932893
                                                                                                                                                                                                                      SHA-512:563E145B572369C7B18774379A95DD745DE4FB3D27B0FD12470C558F930FD0BE2718ECF907215F255A91F115A0D86F1FDBE672FF3CE7CB628CCBAB68A16A70AA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATH...1..`....}....,.&..J$mR.!q....T'.K....I.1aq.B.q.a..g~.Z_.b!....0...^>.....S.R...\...w....B..WB...b..O..Q0.R6}%$.]-.x..1........\i,8.0...a........%......%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-bg_glass_75_79c9ec_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):406
                                                                                                                                                                                                                      Entropy (8bit):6.591491659482794
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7J1r+U9+ydFO8FSF2FrzS+Em63KEMlOX:krr9+ikyzjEmdEMlOX
                                                                                                                                                                                                                      MD5:91B2A996DF0F598E2C3256D1BBBAEFC1
                                                                                                                                                                                                                      SHA1:9CA8B4C79EE52D4CA3F3158068DCB861B0F9AE68
                                                                                                                                                                                                                      SHA-256:20DB51643CC06CF91D7E2D76504D0669D3A793FB9B90C1CCF248C72E8B0F1AED
                                                                                                                                                                                                                      SHA-512:518C362686DAE2743C79E44F37C6D3B565B21B533FB48FB29F4634A7EC986203149387DEE6B390000092C74F84BE7121A7456208ADAC78BC1F3E2854BDEC5573
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATH.....`...s...Ddf..^...;0,Y.^.qE.`..,.l...u...A....5../=.........a...u.....I+n.Sm......\(HT"S.+b!.Q..\..+......O... w..;..Jf..oM.&...St...i.0..../."...+...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-bg_gloss-wave_45_e14f1c_500x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5922
                                                                                                                                                                                                                      Entropy (8bit):7.68968045947838
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:fH3oGRMuCB+5wSTTJCCK1iycpnINYXYOT5TgudhYYz+7qazYaLhIAKg:P3oaMuUST759/T5TgqhYW01zpO5g
                                                                                                                                                                                                                      MD5:1B850EED5228F446BDCA7FFCDA647EE8
                                                                                                                                                                                                                      SHA1:8FB9F3FC3BF58564F5C752972C6F53846F281FE9
                                                                                                                                                                                                                      SHA-256:66CBB2F82EE5CF5C1386AE154D925F3B4481CA52671E98CB15CF050F8129BD84
                                                                                                                                                                                                                      SHA-512:9272E8C34CE6BEC23062FA5CAB0F4A59E0A34E62918FFF2210CE9FE564C92CB6BDA0C8D4AFF7D4F2C2384974DFA1C4E09E8EBD19F9BF9809E111B585E8756748
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!...&IDATx.._.e.]..>..>.{I.e 05j.1c..A.!.j..&.. %.i...Z...,.4..P1!...i@..m.......6..4>t......Z...=w..ot.Y.~......3.|.............W.....{/<........XaF.v......n..w.....5..;.............`..........pp.....X.8........................k..w.....5..;.............`..........pp.....X.8........................k......&7i..S}..K,..)....>)...yj....W..BI...-.\....;..5=..x..*.)1..T*-o5......SW....U,xc.b.+..k..d-......(..[{C_-.'.+P.g^.{.5y...l...X..J,%....<c...?..=........B.<*3m....?W......,W..oJK|u..\...c..(=..-&....[5^..s-..k.a..U......^..K4.....G.j....N...-%+4...U=Syw......{-.y...7o....~...d.........Y.[........o......X.8.........0.{.$l..f...=...........I..(?.y..*..=......#.].ev....>.5.N.....[...V..YV.+k.....j.=..]..nJU..){.R-...........F.W..N....=.......d.K...~.J.Wyy.F..Yr.+.l^.)%.\D..k.......lv..]S;k..K.....~.>..}.....e..8...ym..ymR.)..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-bg_gloss-wave_50_6eac2c_500x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5964
                                                                                                                                                                                                                      Entropy (8bit):7.6902055019466475
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:fHORrlGaNFuGTEqceljT7JUI65e/MFuN7i7OlGRufe/95ZCsCfXyRT8x:PCrMaN4GgqceZT9uM0RGGRuW/953VO
                                                                                                                                                                                                                      MD5:879551094DE8697DF488B81F917ABD54
                                                                                                                                                                                                                      SHA1:AF147D410236C3C09F1312782916480FC6A5EB57
                                                                                                                                                                                                                      SHA-256:D893CA2B0E379858C35368EB8892CABA6BF504F038491847CC7EBE0D97C90717
                                                                                                                                                                                                                      SHA-512:A55A54E59615BAADF46EDAB3ECFF3BC4E22A2703A2F266378329F47244CEB7636E100FEB5BA6B18C10EE1DD3AECDB700AEEFE852A8B8C15CAB1E99B0B0F16FC5
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!...PIDATx..O.e.U..^?.....o. f..m.%@D$...-.,..QBPb.....i$.@....6,.O..#$.$H....~.D.8d..b..xf... YHl.b..eq...TW..T....-.N.S....5..../^...=........3Y.......p<.......V........+..w........;.............`..........pp.....X.8...............V........+..w........;.............`..........pp.....X.8............n.m......g/..n.Y.E...y...S#o.<.:.-.d....Q..H.e..g....YE1%F=.J..r.V..r......k,}.}e.r..z...}.Q.b.C...Xk..%..r.J..p.&..Q..<V...K..c.#../....~...P.....`.,...7......@]Ob..,W..oJKxu.y.&.i..Ve.......r..........ZuXbm........K.~..y{x]....X.....S7.zK....}U.T..duX#J....<.Z....^..O}..L........f.v..e.......)x...............`......l..;.7.]i.C..Q.];.>..4.Y....<.bZ..L..+..HG.G.].!.m..nM....+%.Vb....w.....I....S5..G.[K7.*b.=P......]^....Z#...^......}....0Y..w...b.U^^..Y{...J2..cLI%..(..z....fn..i.mG[b............l..F..<6oZ....%.....k

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-bg_gloss-wave_75_2191c0_500x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):6035
                                                                                                                                                                                                                      Entropy (8bit):7.688210298202852
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:fHN3nrvlGl8UwCW1o/D4PgnYpjkNaSdq9nyuWrJWHcpfO4nWFR4Aq0p8Y40tZYkW:P1vMrw5MvImawqFQJW8dC+Aq0piV6v+
                                                                                                                                                                                                                      MD5:7DB7584F3F7ED73A0588F5B7A4FF3254
                                                                                                                                                                                                                      SHA1:0EF2E09C002050070F365E43E0C51032D9032337
                                                                                                                                                                                                                      SHA-256:B75E9EAE369B4E83401F6FF941BBD69C7D89C65243AFF1F66F5BBC816E84EE5E
                                                                                                                                                                                                                      SHA-512:6BC3F617041C9670C979596C5A0E8C68B0FD896B1635A780C3596B9648E434D216D44B10ABD9B80DDD26E9D349D2A46113CE7DBE4E98066006393601896CE28C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATx..O.d.u...k.d"#..D."b..e.78...'..$.".,z&..e1..%...l%.a.)...Q$3D1..=i.8.c..%...7^.A..i.H0,.lx....>;w.W5.SU..6|....V.:.wN.-x.o7_?....U.......f.l........pp.....X.8...............V........+..w........;.............`..........pp.....X.8...............V........+..w........;.............`..........\...n.m.[..X...%...1....>1...yj....U.....[.[..2J_.....Z.U2.(..gS....TN.*.Z.].V.>V.`......R..U....6J^.{...._.N...j.=.\..=.*.z...G..o=.....R..X..36_...'..B^........,....[n{.C..'1k.Y....7.%.:../&.i..Ve....-&....[5V..s-..k.a..!.S.f^..f/Y.%....uu..b5\...N...-%+4...U=Syw...a.(}7.Z...j9ho.v.......d......................2.....+..w......`.z......^..............I...EoQ>.y..*.gzv]g]I%Gz...(.+>....)u..`...J,.....b_Y#.Q..y.....h.uk.TE...*.R^]y...o]..XkDy.`....].....q.\L......SPl...5:k..\If.b.)..b.Q...//.._.Y3q...~.....C...t.w-.3.m.,[-.Q.<...!=o

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-bg_inset-hard_100_fcfdfd_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):350
                                                                                                                                                                                                                      Entropy (8bit):6.206000010177241
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPeogUyKfp5Em3MFQ3fK3B6tTLpM52zgN+Em6hp/KEMlOZp:6v/7WogU9+C0MtTLJzS+Em63KEMlOX
                                                                                                                                                                                                                      MD5:63B926C3D199D7774678EC2F1CFEB44A
                                                                                                                                                                                                                      SHA1:60483976063220F6BFC4508287E98522312EE277
                                                                                                                                                                                                                      SHA-256:0AE17677A06192D5114347DE45ED6C6F2C3A660C1202AA6EA44E12BFCE7AFE5D
                                                                                                                                                                                                                      SHA-512:7BE4D05ACD6519F4892F63C0D8F31E4AA6DC3DAA0467B9F93F2B3C3653A87C1CFCEFD267BA03A137EB110C7197F526ED8A03C227ACEB06D2F63787708F103AEE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!...bIDAT(...1..0....`.JE... (z....BHm.......u....~..5w}."....^,..bcb.$..A"..H...V.A,npC...xQ!T..ry.D...H{*1...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-icons_0078ae_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.739187429694133
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:pNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:xHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:C2A2DFF552EE2D63B9B12861425DA8E4
                                                                                                                                                                                                                      SHA1:A50A98BE703E23E4D1FF74752984DB7064E87E49
                                                                                                                                                                                                                      SHA-256:98A221399F8D3673872C94EF3178D43597713A821C92F5EBF5135CADE0F70B84
                                                                                                                                                                                                                      SHA-512:67FB2556D393527FE8AA482A67DF36470B081904EFF37BFE2783AE6D1A8433B01AC20AAA55821B5405E480F1F162DFC6B145B1C1A7FA51E0D7BC7E355B1DE387
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x..x...R0...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-icons_056b93_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.778670676983036
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:zNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:DHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:CB52FFFA4237276F016F7180CA1C1B8A
                                                                                                                                                                                                                      SHA1:F930726B7A6A37A4956E4F732B6FE3869646D705
                                                                                                                                                                                                                      SHA-256:68351A21A09C652481AFAC4962544010A86F5BF4314C5F90723BE35110EF9424
                                                                                                                                                                                                                      SHA-512:CEF74AF1812ECA1C2FB551E204D8E81122DBC638E9799D54CB3AD642C4CE3483AABCC652175E245FA1BF3A07CFD0EF0FE577D3E2B0A5D86DA7E606F652363C58
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k..k.......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-icons_d8e7f3_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.773667817462664
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:3NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:vHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:06F311C437236B376B247382BF815C71
                                                                                                                                                                                                                      SHA1:110DB3851E725E1CD30D73D292201A6699344E4F
                                                                                                                                                                                                                      SHA-256:061647E5266E0E229DEAC8AAA16D839EE64DA5C0E7B972948DAC3D071D27F547
                                                                                                                                                                                                                      SHA-512:C90F60977BCEBDA00CE1D77748A3E2C4F53D9526B867537143D3137E4134858F2C02D45F5521699EE0EAFF6AE4D54C4217714D75E902D89D45EB8826ED51D7A0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................e....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-icons_e0fdff_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.755367374553932
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:uNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:gHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:91403D8B6F91E344BB6E344D26CD51B1
                                                                                                                                                                                                                      SHA1:2280A7E734CF7A259F1BA9201D27AF6A4C4E9F16
                                                                                                                                                                                                                      SHA-256:98B45E794E837E483E570BBEE898F2049D4C1DDDBFDA479A9C9F613D3840E24D
                                                                                                                                                                                                                      SHA-512:7F4E5C3D06FEBA1BCE4272FB915A6DA14BE80EC9A7D72C69B1CFC92E6A73F0A0B22CBABA9CAA038EF194B090DE2711435BD8DE78318B4972CFB3325D62C5F754
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................q......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-icons_f5e175_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.768313863902363
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:RNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:5Hm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:4541A85EDE9D67D454B0D0039EF8728E
                                                                                                                                                                                                                      SHA1:7B51B7204AEAB4AE63FF354EDAE3BB2F8AC107DA
                                                                                                                                                                                                                      SHA-256:38876FA7B854610BA82FC9D6C03941E79C5C28ADC7BCEA89B99BD2E0F26C3234
                                                                                                                                                                                                                      SHA-512:9EEECAD2896A1A68D2C95ACF9D88A44ACE50BBEB1F26F64C1171DBA95B67528F81E7D890DC6C35B0C8F703282B8E1122F7D189EE1C7990B24434BDB426FA37E9
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..um......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-icons_f7a50d_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.77507517756097
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:wNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:CHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:64EC6FBEDFFE32AFBB48E5AA85BF086E
                                                                                                                                                                                                                      SHA1:38844861F9CC3A3CD0C9780CDB75430BA7BCB6B1
                                                                                                                                                                                                                      SHA-256:5C33DD220D270E399752CB32BAFEDBCC89AF5019A6D921436796AED89057BDD7
                                                                                                                                                                                                                      SHA-512:C8A092A76E64FE2AAC4560DFF007F036C20C11DBCED03372BE80207BE9F7DC3A08297F72AE2E51CAC99B66DA5C22BCB71E64C9CBB051F92B3EE82E1FF0F8C968
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................n......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\images\ui-icons_fcd113_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.773382235778011
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:tNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:9Hm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:BBA8336D01DF6BBDB30678452364950F
                                                                                                                                                                                                                      SHA1:2031FFC7B941B7F7AD9CA0179FD4506174D0F57A
                                                                                                                                                                                                                      SHA-256:167523F77EEAD492792DFBF71392EF5C0D3D09BC564F7087B756C7CB2A10ADC9
                                                                                                                                                                                                                      SHA-512:19D4F385CB920D227547BC6850C33A54078EC7A82858644D762CC88C4A58B2B940C53089C73F423D186690DBEC2E2CD4CEE07B43AB06E10150FA5F6EBD373C76
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE............................................................................................................................................................................................................................................................................................................P\;....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\jquery-ui.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2363)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):36629
                                                                                                                                                                                                                      Entropy (8bit):5.281302252210388
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:10OW0gu02b6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHlnA0G:cJ2b/+vaW1e07pF5fycE2xDS25Vc6Kv/
                                                                                                                                                                                                                      MD5:27CF8B6EDE40F8C30CC8280B7ACE0782
                                                                                                                                                                                                                      SHA1:82E878D033753893ABBDBB9DB871DD2E2A0A61F2
                                                                                                                                                                                                                      SHA-256:187EB517154BBD2784CEE91F411F0E7147C894240B9667A7B4540C2E8E2D9231
                                                                                                                                                                                                                      SHA-512:03574345B653979597C0E96407350FB5B97DBA996B56A44C21366551476761EBD9AB52A25396A724E04C320FC50F28459050B2F2708E3640468CED7BC7884958
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=2191c0&bgTextureHeader=gloss_wave&bgImgOpacityHeader=75&borderColorHeader=4297d7&fcHeader=eaf5f7&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=inset_hard&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=0078ae&bgColorDefault=0078ae&bgTextureDefault=glass&bgImgOpacityDefault=45&borderColorDefault=77d5f7&fcDefault=ffffff&iconColorDefault=e0fdff&bgColorHover=79c9ec&bgTextureHover=glass&bgImgOpacityHover=75&borderColorHove

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\jquery-ui.min.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (29611)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):31387
                                                                                                                                                                                                                      Entropy (8bit):5.224818221402447
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:cJ2lcR8lOXHc11evj9zRmaG+4Q6G8sjy0Sc7nfZBhVBE:MBXHcEj9zMaeQ6G8sjpBhA
                                                                                                                                                                                                                      MD5:7FE6AB79E159819A4DB99D24B79D7EA5
                                                                                                                                                                                                                      SHA1:611FE487009CD7FD815854F29F49197E81F9EAE6
                                                                                                                                                                                                                      SHA-256:F80A56801FEB59155E1917A23B35155E43D7233CE28087565AC1D04A799A744E
                                                                                                                                                                                                                      SHA-512:2831924AD6BB21A61FC1B72F5836111791E978368539AC78B3F67CB20408C380A823A7C10284E8D3B47804E7C68A516340F3DC997965EAC960F1BAC55261827D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=2191c0&bgTextureHeader=gloss_wave&bgImgOpacityHeader=75&borderColorHeader=4297d7&fcHeader=eaf5f7&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=inset_hard&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=0078ae&bgColorDefault=0078ae&bgTextureDefault=glass&bgImgOpacityDefault=45&borderColorDefault=77d5f7&fcDefault=ffffff&iconColorDefault=e0fdff&bgColorHover=79c9ec&bgTextureHover=glass&bgImgOpacityHover=75&borderColorHove

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\start\theme.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (1353)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):17975
                                                                                                                                                                                                                      Entropy (8bit):5.088177344743783
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:X6u0OnA0vTF5fyh+MuEcrYu5wK/lgmB0iBfT9RhS2wV53skuMaaSQhQz0iIhqc6C:X6J4F5fycE2xDS25Vc6Kv/
                                                                                                                                                                                                                      MD5:8BA00131EEF33D92C25C87E22E083D54
                                                                                                                                                                                                                      SHA1:64AD37E5B12A6EB6A4C08873DE00ED3929621041
                                                                                                                                                                                                                      SHA-256:58EF3F583F08153750829DC6962A083C933DAD72FD1FC62D8A837FCEBD7A445E
                                                                                                                                                                                                                      SHA-512:04F83B486E52B4D2A10DE05F5D5C788CB8B798A536A39F043B73E9FD95143FC6D7B5BA8D63DC41E1E211EA1D17CB77EF00C81EB573D98B11473D61988A2C0E6B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Verdana%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=2191c0&bgTextureHeader=gloss_wave&bgImgOpacityHeader=75&borderColorHeader=4297d7&fcHeader=eaf5f7&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=inset_hard&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=0078ae&bgColorDefault=0078ae&bgTextureDefault=glass&bgImgOpacityDefault=45&borderColorDefault=77d5f7&fcDefault=ffffff&iconColorDefault=e0fdff&bgColorHover=79c9ec&bgTextureHover=glass&bgImgOpacityHover=75&borderColorHover=448dae&fcHover=026890&iconColorHover=056b93&bgColorActive=6eac2c&bgTextureActive=gloss_wave&bgImgOpacityActive=50&bo

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-bg_diagonals-medium_20_d34d17_40x40.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):440
                                                                                                                                                                                                                      Entropy (8bit):6.645254076771535
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7egU9+iX1+CeVOOinRVMK7bweuRzZ2zS+Em63KEMlOX:X9+esCeVhYjbwegzZ2zjEmdEMlOX
                                                                                                                                                                                                                      MD5:8CB63B9E938439068BAD2D541649EBC2
                                                                                                                                                                                                                      SHA1:2832B94E06C2B4F755BEA3925198CE3C04587C14
                                                                                                                                                                                                                      SHA-256:B44DB4293067191805F55154111AEDB6568AFE4D3B98C491500353BC90D7F83B
                                                                                                                                                                                                                      SHA-512:45DEA1136F5F8280126773543A14CCF5EF20033A9AB17CA2C7C6F0020D256CD7F4F716A206780B01EF9C154E693588F53D2EA8170B9160D1AA3E2707FE80C15B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATh....@......J.Jp.F.n...P..K-818v..l.[...a.l....OK.......v..k......:*9|.Q..J....k..o.&.uTr.....G..<..Q.x:.N..0.nt.I].....a.u...>..O.}.5....k<..Q.x:..t.G].....a.u...>.....%..1;b....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-bg_gloss-wave_45_817865_500x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5939
                                                                                                                                                                                                                      Entropy (8bit):7.703846412692604
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:fH63ESQseVGhA91gbMzgDtdz0RLPgSAmP0FtHx3IV5P3qGoDOEJ3yitdPKs:PMGGhgcrKLPZgtRYVJ6Go6E0itdPV
                                                                                                                                                                                                                      MD5:4234E7CD58DE5D96A698A6EDCDE2A445
                                                                                                                                                                                                                      SHA1:3E382B5328B7E2FE57D0970EC85215C36A3CEF7F
                                                                                                                                                                                                                      SHA-256:CF05534B9CFE492367271847D6BB9BFA8C4100409FB0E680EBE3B5FED82C06A3
                                                                                                                                                                                                                      SHA-512:1BA199160873B686F1D4EF50F1C9296591D9FA747F58A0FFDABE49B6730358352556F2402D01F4EC8443FAC297C12F048AB972F0F7076F9F7B34D041DE2917B3
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!...7IDATx..O.e.u..^.MD.)J28.L.c..V....).& Y.,C."d.-cGa.3H1..Ht..h@...8.!......(.i{.b%.Xe..IH...d...{..=.m.......}.}.xS...9.S...{.w>....p].......3[.......p<................k..w.....5..;.............`..........pp.....X.8........................k..w.....5..;.............`..........pp.....X.8............a..xL.^..c.^b..OYHE=...P...F^.y.yu.-.d....V.....Z.3.W......Me...r.f..r.w..m...X..J/.Zy.,...j....(.{.........7.{M.}="..<V...K...#...s.[.~.rf............v?.u.]...glkv/.U..R2.:../'...^e..v....r........9.k...kS......^2.K4.[...F..p.......KJfh..z..v.........<.Z...W....._+........c..a".A.......<U.....`.............p......x...|HW.._.o'Ugh.&.^.|..*.UJO.w]g]I%G:.>J..)o....q...d..X.o...e.2G.Vz.y.....]uk...5e.TFK....]^}....F.7..k......ul..q9Y..w...R.U^^..yk...J2..cJI%..V......}..a3l......S%.{.......-.=.6S....Q.<O.k.`.k..N.V.].;.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-bg_gloss-wave_60_fece2f_500x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5908
                                                                                                                                                                                                                      Entropy (8bit):7.679038274873359
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:fHC5G5GhcMdQkz/dUbvU7FS6fzEsCWIz+tpuYkEpCMqsqZ/xDIeG:PLqZZ1UbvUNrEOIzipuYQMqsqp7G
                                                                                                                                                                                                                      MD5:B694AF5933744F277DD773B99D56D983
                                                                                                                                                                                                                      SHA1:95B543C087CBFEA02824F1DE7EF0A6447EC4B02E
                                                                                                                                                                                                                      SHA-256:1815DC24733A0B93B2B07882C2EE13CE20FF1AF7826CD8B2CE514B18D2DEE289
                                                                                                                                                                                                                      SHA-512:8FC7200B582F9395F3392F251910CAF52FE473CECFC543B315F0C8EC09EBD6BFADEE4E65C0B3CA0F9744D98F199FA9006833A014BE155BA318420E8F1A5B7BB2
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATx...m.U.kw...m,.-.!..J@...".E0b...Jp.#.?...dY2..n#..B.".]OA !.!....%v...l..'..H(r"..v1......UU.<..o`.kW.Z..u.9{.!....|.,.........n.......j8......l.................[..w.....-..;.............`..........pp.......8......l.................[..w.....-..;.............`..........pp........>....W...V.....~.e....cy..S...:.:..Z...o..J+}^.qE...dVQL.Q.2..fS;u. j....z[.B4.9..K.VQ=[...v.V}.....9.......F..;.(........G.EU%...'ZG.q..._...P.....`.D~*..I:...M..'.5......M)).nB.W.k_..mT.........|.&.a..U..^...&...f]..zo..-...}u.[..1..o.o~....Z.|....evD#.w.:O....!..{....A&.......EJ.8o.'......`.Se..............[......../\.~&?......v|.^....:.,.,=..u.u%.....(.+>X....q....e..X.o..e.2G.Vz.u.Z.y....tSF.eMY....>..rWW?:.....Ct......3...?.&.Q.N\S.S..^..%.].f.Y.%.u1ZJ*.Xrs....K...t0\.[.8.0K..9w...i....G.e9j............./.N.W.].?..V.JJ,..V

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-bg_gloss-wave_70_ffdd57_500x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5601
                                                                                                                                                                                                                      Entropy (8bit):7.678761754017709
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:fHShn55j57kHjG/x0dirogumOBa28bPs/5+HzRCnvf/+gbWof1ohKv0d:PS/H4C2EULBesh+0vnt1dowG
                                                                                                                                                                                                                      MD5:2870BD72CE344FA1230B5290271568CE
                                                                                                                                                                                                                      SHA1:356C051587C717C55F0752EB04C116C886EAE6D4
                                                                                                                                                                                                                      SHA-256:F50F4BF5792D6EB30A71F9FFCC309CEC9B3B3631E07B5CBACA041744D19E274A
                                                                                                                                                                                                                      SHA-512:0BF4113C3DC4C8AB4C88258544B7A22D9042E209F8AC518689EF705ACF9366786327B402C7A8FCF19BD17BD09B7D32496FDD5D82D04462FE556FDC6532876AE9
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATx..M.&.u...|..d!.L.&...L.x..1.E@B".d.@l)..H6......Bf@.0.!..v6.....$.!9....3....3.;..-C..T.=?.[..}O....G..]uW.:.....z.....w.........};......g.......`.0p..............6..w.............`.0p..............6..w.............`.0p..............6..w.............`.0p..............6..w......p...(_9.~....=b.>^.P..LS.P..F[.m.yu.-DJ.[.....va....7^.d.....TjZ[k......kg.5_.V...e.......g.-.mG..o....b...{b\..[..m..E......(>GTUb..?.4b.C.....l.........7U.(]~.....I...~.....)...)k[..Z.2JJ...)....Z.WCo^K..^.0bm.....V.m.G.~D.>...m}T.......-_.H...1_...T..*.:...ws..6O..O..r..O_...2......L..>........v...............6....~...8W.&?..^5M9.SKS....Q.n.UMO;w]g]I..tt}....j....z...%R."..kA..S.JY.....*=.6Uk....u{...5.....v..][zo....F.V..}.~.k.{z..9........}.T......7ed,.)..kJ*eq...?..[)..a.(_6......P).I...=G.f..B.E..Z...v.6....{....B.JQI.EQ...R..J

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-bg_gloss-wave_90_fff9e5_500x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5447
                                                                                                                                                                                                                      Entropy (8bit):7.6937201144293565
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:fHnk+vTQEKQfBNA2Wlv++M0T2H2NqH4+tJcHYWfUSG9jWmHpY9LOu+La0jQu5tB:Pnjv3DA2+mHWs42jWfw9VEqtLa0jD5tB
                                                                                                                                                                                                                      MD5:921941A5B2B71FD18A9CA66102B79113
                                                                                                                                                                                                                      SHA1:C079ECFF626806411093802AEA83D74B4E7D8FFD
                                                                                                                                                                                                                      SHA-256:39BE850DB2EAF01CC65CC9E3D1CDB664211CD0B34AFFF7A563008EB9B284C500
                                                                                                                                                                                                                      SHA-512:AA1236FCDB32CC5E7AC6B18E5F9FBFAC6C565BAA4711C91D44BCED650C700434A595F3A97F3BCEEEADC5D85EEF0BBB4FA4D6C1FA7F81E6726B16268572E3C23A
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!...KIDATx....%G...j.3.7...........A].F..Q.U KW..EV..\..\(...q#(.R..0 ..(.B......"x.r...[S.}.z..tO..E...z.....N.)...7......l.{........q..............p..............p..............p..............p..............p..............p..............p..............\}.~.N.\./..c..).^^+...r.Z.J.m.h..-c.<.%Dz....+[.....oiz.z....1..zo*#.mo.k...%.>..|}[..o[F..J-.\y.......]..U.1..V...F.....z.o..Q2....[m.}..#YU..9.x..k.r>...mn*...............o$...Z...ol...-..:}mg....eM....x....o..u.9.{..Hi[.O.2........y.1.o..Q.1.....o..K"{h.q.U....V....".l.-.-.o..O9....uI.....ANRJg.......`.2.....p.......Izg......j...5.[-.\.S[.,.V.E_...-.Z.j..k..gR.#....v%.Z.e~..q.....o....A..Km.....#.Vz.mY....{..7eT.JS...,..]m}..w......m<x.u......=..8?...^mW\K.UP.x../..y.\.Ez....L*}./....'SJ...K.Y.%.9....../K.k....-.lE-.Z.v..zm..)..ZG...J..,)mQ2Y.W..m..d...";.Z9J.){..1..%?#J...

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-bg_highlight-soft_100_feeebd_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):401
                                                                                                                                                                                                                      Entropy (8bit):6.547463981344383
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7WogU9+4hdiSjdOBdKfzS+Em63KEMlOX:no19+Ei5+fzjEmdEMlOX
                                                                                                                                                                                                                      MD5:7385E960B273254918C00B999D211F03
                                                                                                                                                                                                                      SHA1:5ADE46E5B00248C7E0BF6392E90AEEB192308D36
                                                                                                                                                                                                                      SHA-256:CC61DC20EBADB222C6D6AA6395448F53442159CC122CAEB14863426DBBE493AF
                                                                                                                                                                                                                      SHA-512:07DD8A4FF7A1FC7B7BE4D79756D1C180D55EDD2E4163C66E964462AF6AB1757B4B156C3E383688F68D49C1B70EAC1A82A469BD52140143B9F43C0BFCD3D3486C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDAT(..1..P...w.O`..'.....o GPJ.L.........W....d..-.m..2......cP.Kc`.*.4z.>1.k..N.b..........F.t..6t..~....i39..^....B....x...4..._.q<...\.......%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-bg_inset-soft_30_ffffff_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 1-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):261
                                                                                                                                                                                                                      Entropy (8bit):5.51952304670403
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPQUyKO0kMhgyOTd2zgN+Em6hp/KEMlOZp:6v/7oU0g+YzS+Em63KEMlOX
                                                                                                                                                                                                                      MD5:A02AF3EBADC6530042FD793EF06FCC45
                                                                                                                                                                                                                      SHA1:7EED4D830D533DF011FFDCA7D421724E2DE6DEE7
                                                                                                                                                                                                                      SHA-256:773332AA0C96DCE46525C2D1A445C2F9031735ED8FC46D149C754984CB7C337D
                                                                                                                                                                                                                      SHA-512:B77F6A70CB772C852E802113BF63F034A656DC70E5A7843E005419935360C73B05F003C2A90060FB665F48D1098EA09C04FF3BEA6ECA8B668D6CD34FA0E6E0B3
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d.....oWg.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME....."....!....IDAT..ch`......2.j<z....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-icons_3d3d3d_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7074
                                                                                                                                                                                                                      Entropy (8bit):7.919346283987806
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:0b5ACzsCSZcc1XFvamelC3AHKBQtP+yuu1GCntG1pJiwIqRWiqc9ed9G+k2Io:Q4CQlnH2ldGCpoRzqcAez29
                                                                                                                                                                                                                      MD5:18BD9AE0A3BCC97841BF36D515B90AC4
                                                                                                                                                                                                                      SHA1:D54C01803D23762E08554CC6075518B2CAABF4D7
                                                                                                                                                                                                                      SHA-256:098A92099477A79D3EDFBF2F0875D2485704690BF2A34FD14000EE00AFAE01D3
                                                                                                                                                                                                                      SHA-512:6A3FFD1B00304C37B5756FAE282113E204638AC687A021D52FB602B15B8E5586AC7AA74B8F0CE03F85167FAB78B0B02D3CCBA01720FDA280E61AAE0FAFC9B706
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.=..o#....tIME.....%...'E....IDATx..{.eE}.?.H(cX.!..[R.`.Tv.*.J."wL.&j...XA.d.h....Hf..Yq.h...v)0.U...Q.U.P..@.].!&.........".........s..;s.;u.{~.}............&.Ag.c....px...&.=.L.'..d.f.Xj...Z...~..c..{.@.....C..`......[........al..X.......R.D}DV.z...B.7n..Q'...,.......q..$..q..v.C....B..T...2..m..k..5e[.7............x....T.M...M.^?3d.J...[.....Z...S0.Ms..}`.....P(/.f....6K...<..)...=D..`....fb..^......px.h8..4.^.../........@.....q...uF.{.7...2.m..0?..:..vu......r..n.0s....Gs.....r...7.5@..@@....2...t[l.{.S..O..7#...7.d{...e.^@...>]..L..-oz.....e..!PE.dR...=.I.l.O\r..6`.S..`.._gxup....../........@........px.h8..t.....W................. {...\..B0..]....(eQ........T..Q5.[.\B..{...V.......C...!4({\...h.w.g..{..Kh.....l.X..v.p-..Z.^IA.:......ur.&..%5.t.S...Ch...NKgn..\.Pv..:..[(......8.nb.K.Uk...]..A.^.50..\B.i......4l].[.mkA...L"....v...2=.[.Yo..8.2..c`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-icons_bd7b00_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.742716878205026
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:5NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:hHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:58C547F99E4570568CD2952820C60BAA
                                                                                                                                                                                                                      SHA1:CAECBBDAC9FD46026BC49836C7904F36FDB6E629
                                                                                                                                                                                                                      SHA-256:F9CDF7EB3066FDEEF555DD70443C240242234CA5B36AF240BD222A12EBFC88C8
                                                                                                                                                                                                                      SHA-512:207D93EE3FCEAA828BABACCA4096B4993BF18A37D78F9B25264D90040CA4E53F08EB0827284EA509F12AF582A4E97B403132D0E092B92D3800C311F0762CCEC4
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{..{....o...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-icons_d19405_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.776460888119716
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:aNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:UHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:33811FD387B89600054B9B4D630CB7BD
                                                                                                                                                                                                                      SHA1:47AC7CA3C55ECB67A81988BA4B281DE8435E745A
                                                                                                                                                                                                                      SHA-256:68E40DA32A12AF442486BA0220013FF82A343036CEC671EFC2E0A5D4B82F4BBD
                                                                                                                                                                                                                      SHA-512:77D0C1E6D9E50D80CB65A0254E34171AB668CD65BEE32BA81A2A706CAD774254B1B6EB3E43197D2DD5D7F776CE7223070F84B37BD22BBCFBD1566B90FD752EB6
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.........................................................................................................................................................................................................=q....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-icons_eb990f_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.774483769238085
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:8NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:mHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:5BED011F03268413C39AF392BF473E01
                                                                                                                                                                                                                      SHA1:4349B6BBAF0D320D4F3BFE3747C6CA2F99F27FC7
                                                                                                                                                                                                                      SHA-256:C39808377E9431C8964EC2FBFF597979A0F6DC8421D7483FA847FAC7D536E209
                                                                                                                                                                                                                      SHA-512:19C910351FF5B47444F99D7625A4489B74D090E538B01E790F3A300457FAC8365F9220FE80AFAB6B927DD51D178672D6CF9778B1F6FF9A32A2BE2CC6B9C9CCCD
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE...............................................................................................................................................................................................................ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-icons_ed9f26_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.770555207484389
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:fNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:XHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:776F11EB6071FB17D2E75711CE1E89D3
                                                                                                                                                                                                                      SHA1:8354AD062CE0B5148719977311DBD23297F01579
                                                                                                                                                                                                                      SHA-256:BB48194B1AF84D1A99F8F723286EA5F752D0DD76519207B677677139E7A77268
                                                                                                                                                                                                                      SHA-512:281151539060035BB7F09739ED2ED2F959113EA1F8298DBC880924547BFE6C9B0FFB1CBB29D71A1CFBD72BF5D791065D31214BF35545075E0602960D54593607
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.&.......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-icons_fadc7a_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.767152740736307
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:zVNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:zlHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:E8D6D9F9DB95005603433CDC65F4186B
                                                                                                                                                                                                                      SHA1:9BA6A7D43C9A9C1DA0432AB160BE638E87F89402
                                                                                                                                                                                                                      SHA-256:D50B564FA87639E5677BF17E196A158AED18223B34B51EB866F0C9B06BE3BD8A
                                                                                                                                                                                                                      SHA-512:BB9B0DF811F8C2508178A83609E0852DF6A851EFA89ECCDF20F24352939E7EC7A886B05A4A1F6AD600F533EE2B8CEA6E4CA88A1A4EC4473A653DFAFA05BE51C4
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..}!...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\images\ui-icons_ffe180_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.758025434515704
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:HNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:fHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:480588FD701F6364B94ACE011BAFA5AD
                                                                                                                                                                                                                      SHA1:0C51698F7DC2229D60AC2E526419D4B55B839023
                                                                                                                                                                                                                      SHA-256:A5A52E32D7DE992033BC16D32E0DB66C5B367F1A38EDA828214C1F70AE99A54E
                                                                                                                                                                                                                      SHA-512:DEC9ABB40B77F6074E1740351F7E8B785A7EDC14A173F3978821682C7D408FC1DA56E454AB557043FB25A2C5BDC7B27B67E92F4DB53839792BC17CD418B1C2CF
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE........................................................................................................................................................................................................D@@....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\jquery-ui.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2363)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):36679
                                                                                                                                                                                                                      Entropy (8bit):5.283625431419401
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:10OW0C2rcBb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHx2Qd:Dr2b/+vaW1e07dF5fyFEuDS25u
                                                                                                                                                                                                                      MD5:22BE2A4668EF7388D02F010F5687AF0F
                                                                                                                                                                                                                      SHA1:755F83AD7BB15369A614494BA0E6278C0313B261
                                                                                                                                                                                                                      SHA-256:2730A7FAF0B7C96FE8FEA5C4B1A403C2748F73A5DEEBA6C3E76544FDE765DF3E
                                                                                                                                                                                                                      SHA-512:32635DF30CF7209ECC76C1D6DBC78C4FC4E12325F53B1012B21CA2190A4C56B2BB2FB787889C121C62873741F5BCF4842B0BF1AB43A3C5D654DA090AD51ECF9A
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=8px&bgColorHeader=817865&bgTextureHeader=gloss_wave&bgImgOpacityHeader=45&borderColorHeader=494437&fcHeader=ffffff&iconColorHeader=fadc7a&bgColorContent=feeebd&bgTextureContent=highlight_soft&bgImgOpacityContent=100&borderColorContent=8e846b&fcContent=383838&iconColorContent=d19405&bgColorDefault=fece2f&bgTextureDefault=gloss_wave&bgImgOpacityDefault=60&borderColorDefault=d19405&fcDefault=4c3000&iconColorDefault=3d3d3d&bgColorHover=ffdd57&bgTextureHover=gloss_wave&bgImgOpacityHover=70&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\jquery-ui.min.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (29652)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):31456
                                                                                                                                                                                                                      Entropy (8bit):5.228582229143624
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:Dr2lcR8lOXHc11ev98zWmk+4b6GUwQFSc7nfZBhV/:/BXHcE98zLwb6GUwQjBh5
                                                                                                                                                                                                                      MD5:8A6695FD927DA4B1578BC0A55B07EDA0
                                                                                                                                                                                                                      SHA1:82E9666B5E51982A1E2C1A072820DD3D077AA193
                                                                                                                                                                                                                      SHA-256:26269D72781AEBEC6E130F76513B536C526BD524ADB123D83A7EC7D7F78B4D32
                                                                                                                                                                                                                      SHA-512:B7FCA5F397A6C706AB6380F317C45475D580FB4D5250CB544533CDBDEFF3BC59F39A8AFC98CD9332EDAD59F7FF49D797384CAB99E9DAB2ED91DBF50478313EA7
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=8px&bgColorHeader=817865&bgTextureHeader=gloss_wave&bgImgOpacityHeader=45&borderColorHeader=494437&fcHeader=ffffff&iconColorHeader=fadc7a&bgColorContent=feeebd&bgTextureContent=highlight_soft&bgImgOpacityContent=100&borderColorContent=8e846b&fcContent=383838&iconColorContent=d19405&bgColorDefault=fece2f&bgTextureDefault=gloss_wave&bgImgOpacityDefault=60&borderColorDefault=d19405&fcDefault=4c3000&iconColorDefault=3d3d3d&bgColorHover=ffdd57&bgTextureHover=gloss_wave&bgImgOpacityHover=70&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\sunny\theme.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (1381)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):18025
                                                                                                                                                                                                                      Entropy (8bit):5.092719134695988
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:XQ2rcZ2QyMTLZF5fyUPtNt38EcvJmVzYRgmB0iBfT9RhS2wV53skuMaaSQhQz0iu:XNr+F5fyFEuDS25u
                                                                                                                                                                                                                      MD5:6AA923C141500B3D7989C46EEF53602E
                                                                                                                                                                                                                      SHA1:213C4CC09900A1CED6D8A01F05DF34FA0A0459BB
                                                                                                                                                                                                                      SHA-256:BE3C9D96538238974D013BFF2FA18A89A800081BB71B5FB0D8F7A75739EFA47A
                                                                                                                                                                                                                      SHA-512:8EB56EF1068E4ACF585CA62DBFBFE33270B6E7875571DADFD5869531C0AC02F7E9C5759C13F13EDC68B6257196991BBCE4268FD040D295052EE98DCA60601C50
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=8px&bgColorHeader=817865&bgTextureHeader=gloss_wave&bgImgOpacityHeader=45&borderColorHeader=494437&fcHeader=ffffff&iconColorHeader=fadc7a&bgColorContent=feeebd&bgTextureContent=highlight_soft&bgImgOpacityContent=100&borderColorContent=8e846b&fcContent=383838&iconColorContent=d19405&bgColorDefault=fece2f&bgTextureDefault=gloss_wave&bgImgOpacityDefault=60&borderColorDefault=d19405&fcDefault=4c3000&iconColorDefault=3d3d3d&bgColorHover=ffdd57&bgTextureHover=gloss_wave&bgImgOpacityHover=70&borderColorHover=a45b13&fcHover=381f00&iconColorHover=bd7b00&bgColorActive=ffffff&bgTextureActive=inset_soft&bgImgOpac

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-bg_diamond_10_4f4221_10x8.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 10 x 8, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):365
                                                                                                                                                                                                                      Entropy (8bit):6.359300406286935
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPcUyKfp5Ej1aPRmg88IoROJvd762zgN+E893CEMl93SGp:6v/7UU9+JEoj8IoETzS+E9EMek
                                                                                                                                                                                                                      MD5:0C4AD56477CD90EB0069DCEBE576132A
                                                                                                                                                                                                                      SHA1:0AA318036C772188BEA996B19A08CED776CDBA58
                                                                                                                                                                                                                      SHA-256:D1AD219B06B80A6275ADEFF7FC7C50AD93F5F67AD242E28D2EDCED087D0F0151
                                                                                                                                                                                                                      SHA-512:5F642659EEABEA648BA3C85CB839EC49003CCB1F6547DE36285305651B9A68C3FB4F187A01B43F14C7FED2CFA87A5BC26ECBEC323B3D1ACFB75E84F340C67EAC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...............%.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......qIDAT..c.........:......`.a..~.Y...6.}..<7!$.C.piCV...F..''EE\.0..._...C.,...x.....@......W.C.........!.._a..."...R.S.[I...%tEXtdate:create.2016-09-14T13:34:11-04:00.v+....%tEXtdate:modify.2016-09-14T13:34:11-04:00w+.I....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-bg_diamond_20_372806_10x8.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 10 x 8, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):368
                                                                                                                                                                                                                      Entropy (8bit):6.341460797434122
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPcUyKfp5EQ4w4iJoDa+J/uh+yRORCwh7zgN+E893CEMl93SGp:6v/7UU9+Qv+a+Vo+rcwh7zS+E9EMek
                                                                                                                                                                                                                      MD5:90D7BAD55C1DB9844BCBF735DAC1F074
                                                                                                                                                                                                                      SHA1:1AEB567353D7A6937979BA8D388D6190C9D7D2BC
                                                                                                                                                                                                                      SHA-256:F3E3D4CA130EBC403DB3A0009B9FE2A52AD978D6E745A9ACD0FB7AB9657E76C2
                                                                                                                                                                                                                      SHA-512:83F8F1664B8133187019ABADECA53A10BDE2E718FC12B6A66903DC970D9B62D95463C69D2067AC98B0882E2D04E781C8A893785195C0D2115EA8B83D2A05B40B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...............%.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......tIDAT..ctM6O._..>].x.}4......\.,.K....c.K....L..!+.e.........m....O. l.d..l.".^f ......W.C........_.#...\...l....dS..X.e...%tEXtdate:create.2016-09-14T13:34:11-04:00.v+....%tEXtdate:modify.2016-09-14T13:34:11-04:00w+.I....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-bg_diamond_25_675423_10x8.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 10 x 8, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):370
                                                                                                                                                                                                                      Entropy (8bit):6.364510427201636
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPcUyKfp5E6nKyhIPHsKznqygKgj3vzgN+E893CEMl93SGp:6v/7UU9+6nB+fq7zS+E9EMek
                                                                                                                                                                                                                      MD5:5AB9A60FB50076625FD74755BCE76859
                                                                                                                                                                                                                      SHA1:6D322B4FE90AE0214ED49E065F3F774B29B1D3C5
                                                                                                                                                                                                                      SHA-256:CB378A5778653E235F5A930201DE24E3EDDDCB820BA87EAFC690DEE381C34317
                                                                                                                                                                                                                      SHA-512:0BFEA8A8A42CE5FD47DE2CC0E31080D940BADE666020792752C9ED339D69F0100486B6E091770ADF4B42B6A6BDA9347360DB78D671A3DBDD27DDFBECF75D2451
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...............%.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......vIDAT..c,..\e....|..x.m3...-.W..E.a.M..>.+....L..!+.e.czzH..2.m....s..:.6.....o._V.....p..l...."L.}.?D.kSs.......`....][..9b....%tEXtdate:create.2016-09-14T13:34:11-04:00.v+....%tEXtdate:modify.2016-09-14T13:34:11-04:00w+.I....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-bg_diamond_25_d5ac5d_10x8.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 10 x 8, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):371
                                                                                                                                                                                                                      Entropy (8bit):6.349255898525815
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPcUyKfp5Efw2TjvJM8e6Q8iUEb+vICiKzgN+E893CEMl93SGp:6v/7UU9+fwIJTVy5E//zS+E9EMek
                                                                                                                                                                                                                      MD5:5ECDEA282139116CF454F59CD8F537D1
                                                                                                                                                                                                                      SHA1:5B6C7458B943F228CA0DDAFB4DC49FCD3ABF9440
                                                                                                                                                                                                                      SHA-256:9820FE8B19C77127DE4F323E5CE727B46AFE526288CADEF095C447E9D85BC5B5
                                                                                                                                                                                                                      SHA-512:167C6CAEF5D76AEE93735927EC67FE891CA12870D0C6EFE904CFC8ECF021BB41057E48EAC649C4DE2EE9C8C20640590B3831FF0E11EB5B4A040D3BCBE94195AF
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...............%.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......wIDAT..c...-{;.....c.e...e.G._.....ml"<L......L..!+.e...k......~.......G.%.-.....~....p.3.....a..+.!.x..u%gq..W.A....L....q...%tEXtdate:create.2016-09-14T13:34:11-04:00.v+....%tEXtdate:modify.2016-09-14T13:34:11-04:00w+.I....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-bg_diamond_8_261803_10x8.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 10 x 8, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):368
                                                                                                                                                                                                                      Entropy (8bit):6.381127254253966
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPcUyKfp5E+pNMNEveuJHIYli8z3NaoG2zgN+E893CEMl93SGp:6v/7UU9+YmNEveupL9ah2zS+E9EMek
                                                                                                                                                                                                                      MD5:855FF8ECC98B25F215023428712CE7DF
                                                                                                                                                                                                                      SHA1:172BDB83B4167BF93E525409CB615AC084CDE564
                                                                                                                                                                                                                      SHA-256:B3E3D422D3DC49E0E158E68C57D1CD26A50D61857ADA726D7CF64453AB162924
                                                                                                                                                                                                                      SHA-512:3ADA1153E631BDF83CA5FA480615F8822B20D0CBBECC200C8E8063DD6C681622AD7F11524D3D5A053E0DADFAC201816248FD5DB8F69FC880CF5E868C06ABF9F3
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...............%.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......tIDAT..c..[....~..U..6..`Sg.aWE.a....k..j...P&\...2.QMMB....6L...7....6.....?..T...p....}.?D......0..)..[..W.......P-.....%tEXtdate:create.2016-09-14T13:34:11-04:00.v+....%tEXtdate:modify.2016-09-14T13:34:11-04:00w+.I....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-bg_diamond_8_443113_10x8.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 10 x 8, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):368
                                                                                                                                                                                                                      Entropy (8bit):6.3299103458725385
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPcUyKfp5ELxMOLyoPRvmkz1N6ipF7xnlKzgN+E893CEMl93SGp:6v/7UU9+LxnLyoPAI18E7dlKzS+E9EM/
                                                                                                                                                                                                                      MD5:0A81FF0F2DDB965C675C7FB95A340BEE
                                                                                                                                                                                                                      SHA1:992441E9D1E2E4C4CC35BE963EE7A9D87AA17BAC
                                                                                                                                                                                                                      SHA-256:6BFDB6EEC896A086DDB70B06DDFFCA458579235B08C1FDDCDA935EF1079EEC6A
                                                                                                                                                                                                                      SHA-512:CA6E45BE527F7C317F8458052D54721147B6DED81E8313BBB72E84F7090140D7583F391C72C981D5776CC29C316EFE9A45A96CF80112991638A41529D1C7A27B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...............%.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......tIDAT..c..h.!y......K.?..`.e...Y...6...].o!$.C.piCV...F..CCaa\.0....e_..Y.%........!............~_...F.7V..p..W.A....O,npW....%tEXtdate:create.2016-09-14T13:34:11-04:00.v+....%tEXtdate:modify.2016-09-14T13:34:11-04:00w+.I....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-bg_highlight-hard_65_fee4bd_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):372
                                                                                                                                                                                                                      Entropy (8bit):6.384221632259222
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPeogUyKfp5EAUbEn19st28A04nqJ8qlRVgiFcSuf+vzgN+E893CEMl93SGp:6v/7WogU9+ALn3sXADn6lRVgoxQ+vzSp
                                                                                                                                                                                                                      MD5:298B2329A688FE3BE43FF15754D3ECFA
                                                                                                                                                                                                                      SHA1:77E39DA0BC3193E4B125ADDB9B6ED6BE0F0DD8E9
                                                                                                                                                                                                                      SHA-256:C7324EDA15AC8ED7B7705EE989AC028480A654606B00A53CC588DDD53AB76A24
                                                                                                                                                                                                                      SHA-512:70AEF10577B1E1522CEB34AB5FCE5D3DEDC3F457398F44BF728DE066058EE534FC2730FC0DD23FE219FDEF5AA9176769BF8BEE89C2D81D02F88258D367F62FBB
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."......xIDAT(.....A.D.QW.XP.p-@B.G..h...*h....s......MHP.xc.o... ....x..*.].Dv.H^.,FO......&.btSO"..{...L./c%...r......!.B.:.P|v]...%tEXtdate:create.2016-09-14T13:34:11-04:00.v+....%tEXtdate:modify.2016-09-14T13:34:11-04:00w+.I....IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-icons_070603_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.761923804558602
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:RNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:5Hm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:52076AEB12F3F4125FA6C5200DC2CDED
                                                                                                                                                                                                                      SHA1:875EC60B0B5B04D87FF4AE44C20C4E555F6BC298
                                                                                                                                                                                                                      SHA-256:A02BF13EFD09394F94DEB427F08EFCB57D8E22C03F85E6211E1542EC86561BE1
                                                                                                                                                                                                                      SHA-512:65A0399BB73F911B28862CD052A94A19A072BE1273ACE7E6FC66C7EFEB68E3E35AD8FCB0E3BE74D23B8B4D002EB15237F8BAA46E9D79177F7C9BCF9D46213283
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.............................................................................................................................................................................................................................................................................................................s.d...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-icons_e8e2b5_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.773782478619946
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:nNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:/Hm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:3F7E25352259F2D9287379BB49F4129A
                                                                                                                                                                                                                      SHA1:ED8411A6BC4DAC4ED86FDC740C4FF513C9963FFC
                                                                                                                                                                                                                      SHA-256:15A23E52BE0364E297B9E6915278E375F351CACC2C2ED9A5BB186DE125145086
                                                                                                                                                                                                                      SHA-512:87828FE294E2DFF9C6D754ABC3336CE6E0998DFCF98C67B90BAEE1D5B6ADA88DE1F782942B3402E34A47EE2CAD0E4CC02F23A1968A362982C6CCEFBFACB552F0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE........................................................................................................................................................................................................L.....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-icons_e9cd86_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.773474449917077
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:nNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:/Hm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:D3F0FA26B37CCF94A53EBCC2406D5ED0
                                                                                                                                                                                                                      SHA1:00B4CEFDE751F65A2A8FEF6FE17E15393E40BDF5
                                                                                                                                                                                                                      SHA-256:0A4704D6AE092BC49A0072237AD91EA72C42025B3AC37E56D737D00057DBF64A
                                                                                                                                                                                                                      SHA-512:F8EA60FCCA9C66931B66CF6C174B3DAE0E588BAB560D6371A84CBBA15E01BF6754D293A4EC94F0A53DD7E2CDA26EC0AB1C853EC17C7A79D112332670BCD5A00B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE........................................................................................................................................................................................................$.6....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-icons_efec9f_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.773201461632952
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:9NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:tHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:766D9DE9AFB37ACB6D3B2D63E58624B4
                                                                                                                                                                                                                      SHA1:C2690B02EFD7BC1995A0FD7134A2944B824F34FB
                                                                                                                                                                                                                      SHA-256:749EA0F36E027265CCC24949F9F6B683F862E3B6B285F66C35ACEB258C79D6E7
                                                                                                                                                                                                                      SHA-512:E899F5E3B2E195F89B167D5145BB1B304CA2E9AA1BF39872356FBC3FC003F747CDF5A36B3925B3AF68C3C90E22E2FA721226E1510CE518AB02A9272338CEB95F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE...........................................................................................................................................................................................................[...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-icons_f2ec64_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.771441630990325
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:ctNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:c9Hm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:78A0CDD2A1CB63ABA98233AA0FAB4403
                                                                                                                                                                                                                      SHA1:EBE3BCB06403818A400B345C63BB6702558C1583
                                                                                                                                                                                                                      SHA-256:83AAB22FA7F0D3E71F02EBBA1E924193B043F4C73B11FDCDE09150A23B5E9C78
                                                                                                                                                                                                                      SHA-512:EA2E9967D3DF3D5E40A03022F02389EE1B3D6C7CAB3B0CCEF9C34339CC4285C8404E680AAA47E8DC8E235EE47762D03225F2C40DDC3952A47FE41597AA483A55
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d..d......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-icons_f9f2bd_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.774286621668153
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:ZNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:BHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:DB72B92A0F728CF5CA2E796BB8B16F14
                                                                                                                                                                                                                      SHA1:01DA752C86E7E385F39D57EEF94727D90CF7DAC3
                                                                                                                                                                                                                      SHA-256:C2ABCB934D66B1C551E084742E0627D22CF0DDF9AB2DBB350148785D2CB87F6E
                                                                                                                                                                                                                      SHA-512:1DA590DCD1D670A6796135875E4EFA8577DA0148DC17C23323141E0368217D412A876860108354D9E5B1243759A34922258138F00231B8A615583782187824E4
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE........................................................................................................................................................................................................'..2...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\images\ui-icons_ff7519_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.76872546534799
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:MsNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:XHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:90D4B95F7F5018E66653FF33D32F35A6
                                                                                                                                                                                                                      SHA1:0AEA94585C167FB945886AE060AF265690E11AA3
                                                                                                                                                                                                                      SHA-256:5E8091D9C902F959F52E76DB516B55E2AAAC0050073A1815AA3A2DF53EA7E9CD
                                                                                                                                                                                                                      SHA-512:68A8B2C2430E1AEFEE986C32B2C877A843E2AE9E94DA6A591860917C4316E35DEEE733EC69EB0368910EA5B4FD298234634EAF84EC9947A71AB3495E6FD3363E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u..u....z...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\jquery-ui.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2363)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):36686
                                                                                                                                                                                                                      Entropy (8bit):5.282561880141542
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:10OW0w0b6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHVjkubuh:E0b/+vaW1e07mF5fyWE/DS25Vc6KTq0
                                                                                                                                                                                                                      MD5:E2BB4786D0AAD000C30B2034700B8C9D
                                                                                                                                                                                                                      SHA1:3EB8126EB7DF461DC1FAECFE8BDA0E5815C0927D
                                                                                                                                                                                                                      SHA-256:0F9F5CB35A2E81A3698ECBE195C723476ABF3BA3579AD162D1386E979AE7CA79
                                                                                                                                                                                                                      SHA-512:7DF5F51BA647BA84F7DEBE1E4F3530F4D9C62F33B259AE514C35E7103276B34725D7D672DE7B8783DD50F19D3393373B3CD60862CB63E18C577F5DBEB76B0440
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Georgia%2CVerdana%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.2em&cornerRadius=5px&bgColorHeader=261803&bgTextureHeader=diamond&bgImgOpacityHeader=8&borderColorHeader=baaa5a&fcHeader=eacd86&iconColorHeader=e9cd86&bgColorContent=443113&bgTextureContent=diamond&bgImgOpacityContent=8&borderColorContent=efec9f&fcContent=efec9f&iconColorContent=efec9f&bgColorDefault=4f4221&bgTextureDefault=diamond&bgImgOpacityDefault=10&borderColorDefault=362917&fcDefault=f8eec9&iconColorDefault=e8e2b5&bgColorHover=675423&bgTextureHover=diamond&bgImgOpacityHover=25&borderColorH

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\jquery-ui.min.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (29700)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):31487
                                                                                                                                                                                                                      Entropy (8bit):5.227925899943147
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:E0lcR8lOXHc11evEUzamB+416GTosZSc7nfZBhVJB7:8XHcEEUzvx16GTosnBh5
                                                                                                                                                                                                                      MD5:3E48471F78CD3C590DA3C207BCB629A7
                                                                                                                                                                                                                      SHA1:F300E9EB2D267B0CD7BD3254D6007B385CC4B498
                                                                                                                                                                                                                      SHA-256:921F677E244AD4D54DF0D63312F00E1D0708AC9B44BF66EEE22AFF4A5CC7290B
                                                                                                                                                                                                                      SHA-512:7F3FD7267CF98193C2A74C222E6BC1F431B968A937EADDC0FB8F9BFF5EE6F2EF0E3F348F94926B05EFC00745C62FD46776164D5DBDB2C815FBED4BEFE929252A
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Georgia%2CVerdana%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.2em&cornerRadius=5px&bgColorHeader=261803&bgTextureHeader=diamond&bgImgOpacityHeader=8&borderColorHeader=baaa5a&fcHeader=eacd86&iconColorHeader=e9cd86&bgColorContent=443113&bgTextureContent=diamond&bgImgOpacityContent=8&borderColorContent=efec9f&fcContent=efec9f&iconColorContent=efec9f&bgColorDefault=4f4221&bgTextureDefault=diamond&bgImgOpacityDefault=10&borderColorDefault=362917&fcDefault=f8eec9&iconColorDefault=e8e2b5&bgColorHover=675423&bgTextureHover=diamond&bgImgOpacityHover=25&borderColorH

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\swanky-purse\theme.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (1364)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):18032
                                                                                                                                                                                                                      Entropy (8bit):5.089695775507098
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:Xa4jkubuF5fyQLBRpBEcEYftrc5gmB0iBfT9RhS2wV53skuMaaSQhQz0iIhqc6Kd:XaZF5fyWE/DS25Vc6KTq0
                                                                                                                                                                                                                      MD5:282A7F8B37DBA43F8EDF8AF548CCB842
                                                                                                                                                                                                                      SHA1:7C4348644E724E38D85B33BA6292E5502CE3194D
                                                                                                                                                                                                                      SHA-256:74EFD4238A4123388DE6669D838E56DEC1872082B1381D1F42272AADDF35CB72
                                                                                                                                                                                                                      SHA-512:6B143E179F98D1C6863AF85593B929F67E0490266EAE4BA4D799257BA8E268919DF21C66AE224866143DDA164771E3576FDA33A64D6780D32E10846C7A68346F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Georgia%2CVerdana%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.2em&cornerRadius=5px&bgColorHeader=261803&bgTextureHeader=diamond&bgImgOpacityHeader=8&borderColorHeader=baaa5a&fcHeader=eacd86&iconColorHeader=e9cd86&bgColorContent=443113&bgTextureContent=diamond&bgImgOpacityContent=8&borderColorContent=efec9f&fcContent=efec9f&iconColorContent=efec9f&bgColorDefault=4f4221&bgTextureDefault=diamond&bgImgOpacityDefault=10&borderColorDefault=362917&fcDefault=f8eec9&iconColorDefault=e8e2b5&bgColorHover=675423&bgTextureHover=diamond&bgImgOpacityHover=25&borderColorHover=362917&fcHover=f8eec9&iconColorHover=f2ec64&bgColorActive=443113&bgTextureActive=diamond&bgImgOpacityActive=8&bor

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-bg_diagonals-small_50_262626_40x40.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 40 x 40, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):321
                                                                                                                                                                                                                      Entropy (8bit):5.969095203566699
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhP0CUyKOkp4/siKZDQ/45urzgN+E8VLEMlVbEbp:6v/7MCU9Z24wrzS+EELEMPS
                                                                                                                                                                                                                      MD5:BEEC31422028ADA44E2FC9F0C67399B9
                                                                                                                                                                                                                      SHA1:CFB2B656953BC92D85A4B24D1789AEA5466313D0
                                                                                                                                                                                                                      SHA-256:768B45202B00BFABBF77CD80EDE985B94ADC9B4D235B7944F7562556DFF5481D
                                                                                                                                                                                                                      SHA-512:27A02C3845C1B84631DDD0C067117AF1B9C116CE7029AFDFC7747428EF2F3C4796A87F0626701E7D1722F7D5460D6B222C53579B5EC526CADFD1EFF583879F29
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...(...(.......;.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......IIDATH...1.. ...<xy....".0.-f(1..t7..LI...g.7W.ysR...I...1..C.1..C.1.......'.KZ.....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-bg_glass_40_0a0a0a_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):322
                                                                                                                                                                                                                      Entropy (8bit):6.013416891415952
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPh8TUyKOkp4/76XEjnd8bsW2zgN+E8VLEMlVbEbp:6v/7JSUm60dcGzS+EELEMPS
                                                                                                                                                                                                                      MD5:82027CE0F484A87E95BCB001765BF9D9
                                                                                                                                                                                                                      SHA1:5481163B02AA1A4126B133D2A04714F373F653C0
                                                                                                                                                                                                                      SHA-256:C447462D023313A40ED37F3B19AE0C252F16BCB9D9B0843B8915113A10E56A5E
                                                                                                                                                                                                                      SHA-512:66C4A129AA5F8692620F29D21E244B5EF288A27F68B061DB755488910CC86C63D2374883E629D1B2E4A88780161B9D08331FCF31D1716729ADB58D056386A373
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR................D....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......JIDAT8.c0Lab`.E........{*.?.....q.&V.&V.&.t...Ll,L.,L,..X.X*....\.....hH ...._-_]....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-bg_glass_55_f1fbe5_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):406
                                                                                                                                                                                                                      Entropy (8bit):6.5436702640430315
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7J1r+U9+Toatzvld9u+UwWtDt66PWnOj2zS+EELEMPS:krr9+rvlcjxGnTzjEELEMPS
                                                                                                                                                                                                                      MD5:3C091997535752F9243F6DED0C2E6698
                                                                                                                                                                                                                      SHA1:850675BBB5B78120333643D19AA3E34176E5063C
                                                                                                                                                                                                                      SHA-256:EA7A70F9E57E75AC0387E23CED494C0B76F5BDC0887AEE232ADB87BCE3EBD731
                                                                                                                                                                                                                      SHA-512:0AFC12F899C5EF305581A03003414FDB097271F173D327FE8CA3444C77B29809ACCE3EB5D7265064DFFAAEA815128419D685D2101B3D90789F4D8AAC0F8C4186
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATH...!..`.........X..`...5.........ch3i..b..........g.._z.^........0...eU.$.mW..JD..2.'K.n'..@.JL ;.....9!..q.t.i[....=e...k..=.eH..RGi..a...y....9.u....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-bg_glass_60_000000_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):323
                                                                                                                                                                                                                      Entropy (8bit):6.029041180694467
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPh8TUyKOkp4/dlUD5kMFUuSSU38EE+gzgN+E8VLEMlVbEbp:6v/7JSU4izFUuFU38t+gzS+EELEMPS
                                                                                                                                                                                                                      MD5:23B3F7DE6E50862D3FCCB373BB9C7B50
                                                                                                                                                                                                                      SHA1:0D022B4CC99ED181474BBC7F21CA8186C402B3E8
                                                                                                                                                                                                                      SHA-256:5A0C0AE716650BEAC2DBB4C97F016D3500597F422E84721B0709CBD946516244
                                                                                                                                                                                                                      SHA-512:76730FAE5F0A4AEEDBC9D2385886EECF350D4F1A883DE59505FEBD6ADD31BC6791EF8508E2DAA3DAE9A19A6C6D1AC8B781D1B5A3E38890B64E628F0BE55AFB95
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR................D....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......KIDAT8.c.-`b`.E........)...*......&.+L.W.8..L...0q\eb.bb_.....e.....w.(.......H.!.....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-bg_gloss-wave_55_000000_500x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 500 x 100, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4360
                                                                                                                                                                                                                      Entropy (8bit):7.896724830756886
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:ft9jMnMxf4/vawA0p587C1KpYOgc1JMvh+r1PNH9:zmoh0pcCLOrJMvhG1Vd
                                                                                                                                                                                                                      MD5:17C87F985475E4C876DEA26A1D0F2E2B
                                                                                                                                                                                                                      SHA1:4D8D1A254AD38F5D9445C0B5F74A8E384281C330
                                                                                                                                                                                                                      SHA-256:9F64350254C1884777FBF7C76DB07A027FBC4DB6B02EEC09462A23023F93574F
                                                                                                                                                                                                                      SHA-512:532C8659F11720326B5C365F409391E799B6CF76AB4530E5F8C465E3BEFDC17EE5058C9B0C27C3A97617A4F1ABC4B607A4B5095076FF49985889F77D1C09FF66
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d......<A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x.......IDATx..]O.%G..j...5..5!.b....A!.D..BB<D...'oz.W..9'.........s....s..w..(.!...&3....?...73/og.....?.......*..;.p8.9.v-....>.Bw8..~.;.{.....=._...../t.c...............p...Bw8..~.;.{.....=._...../t.c...............p......[.M.%...Si.8..^..R.--.M7."I.|.7/.v.:i=....b...j[..Z@.j.q[Y..|.l*.xh~......e).@..YD..SE...:Fl......R..{I.l9........%...Gj....s5..m.j4.....V..hF`.h.Q.V.u.h^.R..^.f...R.gZ".."......E4.........w,.....Vy.g...DB...../.W.#..q.....pl..uw8..~.;.{.......T|....>...(.....B..?.G......eQ.w.$..mS....rK....?D.YeNB...;..v.cj/...-...g.d_q.&...\[....}$..F..K-..%D.!.(c:.NG...RLZ.m.!;r..........5.~8...)R7....:._z.7...nG.....$..i8#..... .M..L.D....(.(...O.Fi.5.L..>N:R.......d..<k..6.i.#.c..^4qIt..D1Ya..|......].,.P?j.:i>q..F..$.y.7..N..IG..S7.....i.m$....QC%o.3+....f..O.L>.....R..a.OQ....%..[\....|.)..|%.J..,..........R...-./.....%Gx

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-bg_gloss-wave_85_9fda58_500x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5998
                                                                                                                                                                                                                      Entropy (8bit):7.68334741302507
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:fH8ylGlwp2hEBlNwyr6H91M4/V4PgTE8GLySYhS26UD8B9YTaM71JhKLCMJLsDT5:P8yM+aEBwyr6fO8SO6UD8rY1JhKLNQDV
                                                                                                                                                                                                                      MD5:90B65BE924BC8BAE9D724E2CC02DC0E9
                                                                                                                                                                                                                      SHA1:39A5955C542327F2F8E3CED937B2CAFCBB11E8D4
                                                                                                                                                                                                                      SHA-256:DE6AC849F1A18F2562015281888F0351C283765346EEE45065544B64994BFBA5
                                                                                                                                                                                                                      SHA-512:B6588480410DAB2333E903442FE79230B73295A08D2773C4180738857E9A53A7D8A0CAAC6402B706C33457EA4C1F6073972EB492C45272C4BF365DB7ADC6E525
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x......rIDATx.._.e.]..>......a..bc...I...$>...)L..V.L..UQcc....K ..P.v.b...!i.a.J.} i|.a.it .cT...}8wt_..|.k.}.>...a8..Z...}....b.>.6...[.~.........................`..........pp.....X.8...............V........+..w........;.............`..........pp.....X.8...............V........+..w........;......p...4l...i..S}..K,..)....>)...yj....W..BI...-.\....;..5=..x..*.)1..T*-o5......SW....U,xc.c.+..k..d-......(..[{}_-.'.+P.g^.{.5y...l...X..J,%....<c..W.z..f...........4..?.@]OR..Y....7.%.:../&...X.2JO;G..E...V.WC.\...ZuXbm........K.~..y{x]....T...o.._..d.....g*.nU.:...ws..<O......_|.O~..L........vk..........*.......pp.....X.&a....a=....\....{vGu{v...vlR..-..<.RZ...g.u.Tr.......6.G.....z+......v..b_Y#.(}.<US.y..tS."eM..S*.........x.7..z..u..........?.&.^.N\].SPj...7:o..\If.bL).."......a=.m6...N..l....s..K...>.m3e.k!.".yj^[.{..%.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-bg_gloss-wave_95_f6ecd5_500x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5856
                                                                                                                                                                                                                      Entropy (8bit):7.695827834591236
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:fHaTHTdjK4IL2FpmiiMs3bDu8/UvKraICsvbjIPV7QAhB76Xgv8yrsKTBIb51OVG:PaTHTdjKpWmiDEbC88fEvPgxQcujO5uJ
                                                                                                                                                                                                                      MD5:6AA84B2BAE200FBEAFD07E24AD43455A
                                                                                                                                                                                                                      SHA1:B185CADC465B2F04276AF2A7E473423D20AA191C
                                                                                                                                                                                                                      SHA-256:F42C18E0BF7B3002629A4F59437E189A9E64CD51B55277FB0DA138992899D016
                                                                                                                                                                                                                      SHA-512:32742795C1E8FD697F9F453FD6A99AA80E96B8074E1505C44167F6E927B4B72C790771EB84DC0832B25D0374ED66D2EC397EF3C62968815EAAD2A415C1D3F756
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATx..O._.u..........".l.J..%1..]......P.P..n.0X.5.jw...-..q..&..iT.h\...4.....&v..E..7..^.oL......{....?.E2...s...s.{.y....s............9.n.......p.p.......\...............f........3..w........;.............`.p......0..p.......\...............f........3..w........;.............`.p......0...p.].:.EoO......oOYHE=..P._.F..e.yu.[.d....(}]...Z.3.W......M...VS..U.:.|}.b....k_.%..W..Z.w.%/.=DQ....>.9'....YV..sM.}=..}..X\U%.....#......|...C........Ufi.....S..')k.Y...7.ext.y_M.....z.Qz.s..\..j..z.Ze....).S.fY..f.....e{x]....T......_.%.B..o_.3Uv....oD....B.'^...._.8..*...........o...... .o........\..........n.eGm.9q.H.>.........3..'5...\.UJ.....u.u%.....(.+>....[S.D..K.."..[AcgY.....(}.2US.y..tS."eM...j.WWY...{W.p.7..z..u.........8?.&.^....WA...,/..=#.r...RR..`Ts.n......;f'...c..-..C......-.3.m.,{-..Hy..7.C~.<....k....B.J

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-icons_000000_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5582
                                                                                                                                                                                                                      Entropy (8bit):7.907240701635631
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:Yb/yH8NygIX6nLdhN93db9hmzC96Xn5J4S4UwYXE2wnlFMeB8M3lVwaK:O9DhNVB9p963j4U3E2OL18M3lKP
                                                                                                                                                                                                                      MD5:7966D89AF8120E125F0FF69C09B0B848
                                                                                                                                                                                                                      SHA1:D6BC3DB4E6BC8FE9AC99016D77D5DD613EDA8712
                                                                                                                                                                                                                      SHA-256:9BBE3706E904C6BB15B897255F62E87955F0A35368EFC3CAD66383B07C27489D
                                                                                                                                                                                                                      SHA-512:59B02BFC125F2902C72FF3712895B6E2CA260A27A3D430C9BA418601330B7C2B475243BAE072BB2685ED58716773D1B5160668FA21EED23C09C8810543215735
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....#2....tIME.....%...'E....IDATx..].d.U..v,.`.D.8..d%?D.!K..../.......C{...h.($.20.....&q/..q.f#..e...d....GVb,mf6!.[Dq2^.ay..Ab......=U......f..T..;.n.Su.a..a....`.0....3....+o......._....].".&^=..E.A0.S.w.../A<......:.............h...@..qO.W.FZ#...b.1..=U.V.=......................~...N...P...........U.v.:.W..9...0..0..0..0......'p...+Z..x.O.n W{.!....@_...}..IZ....k....c.?H.]..."..t2H..j..)U.m=@.t1-..q...w..R:...Nv..9....H..'.....3hY... ..r`...`..cW..a..a..a..a.".yg`.ps.....}.:........n..1.H..pS#.v.^AS.....g.{@/.%v|....c.. %T....Rn............R:..t...0.~.)...7W>..wYIO-~.<...6..^......{..n..0E.................v...#8v..?..._;.RS..N...b...N.1D..F..cL...9U....m.O.y.`/..}.a..a..a..a...E..u.N...h.jI..v.w.S.gY..+@..x.......!..&-. Z..LK..t..-.}..&l..h.......(.QJ...>...([..W...F..@{..pO[.fD. ...~cy...kvj.I..I.~..&....x.......I]7...Rj/._;.M..&..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-icons_1f1f1f_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7025
                                                                                                                                                                                                                      Entropy (8bit):7.92694681304517
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:tVhcH5ZfLGSW2vWMqWNB76LeulcQVmpibEJi28h2O:XqHjLVWQWZWD76SuCQEpDJz8t
                                                                                                                                                                                                                      MD5:A70FA5A611F0DEF8348F06C351A76F23
                                                                                                                                                                                                                      SHA1:CF6BA7CC0A4D02E6D384ACFE69A6AECE3B9688A8
                                                                                                                                                                                                                      SHA-256:3C569FC82FDA71677ED5A74C63F07428AB8EE88E21362D85272A6C17BE55F213
                                                                                                                                                                                                                      SHA-512:E06C39886D6963DB6DF852F3D8BC4747A5A0054CEE2AC39FE3281F6F29EC0DC3D0D01A6B56DC2AE9D614C67E31D3E8B1A83126CCEBDF6710CEBF0906FD1D225B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..'.......tIME.....%...'E...TIDATx..m...y........R `l..@Z.j/..K....m%.I...Jh.^.4!.R.....K`.6%..jmA.!.Km.. ...U.X..v.$.i..:4v.i........9.3s..;...s..y.s..y..`+.M.)....`...px..h...t%....y.Y...D.^.`..O..r.%`.:.$%...{.....0L.L..?..a|..6.....]A......7P..'@/:.]5JH.&.ay.......2....:.8t..y.....@.....#*'..?..t.;.Yw.m..........{.>|Dg7..\J.{.4..K.......3...t.f.Z...`.7.u7..Y.~f].<.....4m.*..<.%%...{.^.`....FR........l8<...O........h8<...O..........k.2..n..6cL...`>.]=u........$....,`.&.+h..k.6..J_*|.K.0...?@..lx..do..m.]..L.3...0.;......T.E,;...4......t...MO...mP.L..U.A&......e...+..`...8u...].5.7.7.~"....h8<...O........h8<.....]..C8.Y..s....Z..}i.A. ...).s.W...!.m.........z.[.#...R.....\R..{...v..........r.....R.. .?.#..[.|.f....`.........y...).A...-..Q.N..4w....:Kr{.......3...Z.P.!0t.{l.\.Y..wSn.P.IA..Vm..-.R...$y.....sI....@;..e.X...v......Y.v...B....n]g.......W..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-icons_9fda58_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.769365641768271
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:6NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:0Hm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:49730AAD2088771F212C33FB18D3D65E
                                                                                                                                                                                                                      SHA1:1BBB14E259D74C023FF328AB5AA75D8A87C9FBEF
                                                                                                                                                                                                                      SHA-256:873FF4B32563F5D6D8650DA05E037F5F8422C6CDB579886D430548543B7C2361
                                                                                                                                                                                                                      SHA-512:9DD054954326D56CCBB0F578CC99ADBD3A466DB9339F717CC26339286C2A712186D449329D5FBBC65AA24006C016C1AB716552999615D488D3060C7BC928249C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..XG.1....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-icons_b8ec79_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.773633402963814
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:6NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:0Hm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:4CB0A6D0B5C53EC1C5031AC876425E57
                                                                                                                                                                                                                      SHA1:4A582B04720D4DD53685E8E0CEEE080308D90211
                                                                                                                                                                                                                      SHA-256:210F3C33CA07E364B75644F215430214C786E88D177159723EF8D962007E2706
                                                                                                                                                                                                                      SHA-512:087B5FD5B50DAA776C26738FFA6A6CBAC88CCAE00F871CF72A00DFAB89B38F591A7A5428CF9749DB33FDD85753CEEDD9A8C5298D1BC9031FD540E1127F86C70D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..y..:'...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-icons_cd0a0a_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.739814671431308
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:ONbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:AHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:A6A39C47239FCDBBE6E1D5BFAA7ADAC3
                                                                                                                                                                                                                      SHA1:E01C6ED29C81AD21B84D0B96427976474D77F21C
                                                                                                                                                                                                                      SHA-256:90044CC699BA3148B8F8777CF7BA69CDB63187582370AE49E3412E00056E05CB
                                                                                                                                                                                                                      SHA-512:48F691B2480F302B2064417FEEF9E28ADB28367FF2CAA549F351DD014F63A75D70AED68B546851371BEC822D7CB037CC644C6AAC1D5C2BC3B6C94E07F00CB87D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..............................................................................................................................................................................................................................................................................................................J....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\images\ui-icons_ffffff_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):6487
                                                                                                                                                                                                                      Entropy (8bit):7.90376532755891
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                                                                                                                                                                                                      MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                                                                                                                                                                                                      SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                                                                                                                                                                                                      SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                                                                                                                                                                                                      SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\jquery-ui.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2363)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):36666
                                                                                                                                                                                                                      Entropy (8bit):5.284323041058013
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:10OW0Cp4b6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHh0Po/8:Y4b/+vaW1e07eSF5fyxHEnDS25gTv
                                                                                                                                                                                                                      MD5:5DEEAF290D0DB83B7E3FE6FA2B76277E
                                                                                                                                                                                                                      SHA1:D547DD72F0280E4E9C551713EE4D61438A395635
                                                                                                                                                                                                                      SHA-256:41C6B4B69C19B71E04E9E6C1FAE9FBDAC2E97D1FBE4BFE34D110E121B5ECC237
                                                                                                                                                                                                                      SHA-512:C4FBE50515A3052E763A49353D18E23CE1DCC773C997B571739B46DA05BF7A7591A0CC6B33B04BD6B5E29D21E0ED80235C86AAB976D5AF8EA9A67739A8A12190
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CHelvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=9fda58&bgTextureHeader=gloss_wave&bgImgOpacityHeader=85&borderColorHeader=000000&fcHeader=222222&iconColorHeader=1f1f1f&bgColorContent=000000&bgTextureContent=gloss_wave&bgImgOpacityContent=55&borderColorContent=4a4a4a&fcContent=ffffff&iconColorContent=9fda58&bgColorDefault=0a0a0a&bgTextureDefault=glass&bgImgOpacityDefault=40&borderColorDefault=1b1613&fcDefault=b8ec79&iconColorDefault=b8ec79&bgColorHover=000000&bgTextureHover=glass&bgImgOpacityHover=60&bor

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\jquery-ui.min.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (29640)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):31434
                                                                                                                                                                                                                      Entropy (8bit):5.228656652836556
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:Y4lcR8lOXHc11ev0mNz/mu+4U6GbzenSc7nfZBhVMC:8XHcE0mNz+2U6GbzepBhB
                                                                                                                                                                                                                      MD5:35C76DACE5BB3A2E7F6B43B1BF3CD721
                                                                                                                                                                                                                      SHA1:37E3D9A815A86F6876222EF509067E6020FFCB1C
                                                                                                                                                                                                                      SHA-256:87E36CD9B3E0EA1769E0112DF0915859FF9CCA362A648F022A61C00930FF6C85
                                                                                                                                                                                                                      SHA-512:A4C19C0E28F5E366C6F5E95BBBFB79AB513881F00F868CD92AF73C9723F77821D2C9D52F03744D451B1B3DFD54489E00D699DF250DBD83135A27B1A681189585
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CHelvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=9fda58&bgTextureHeader=gloss_wave&bgImgOpacityHeader=85&borderColorHeader=000000&fcHeader=222222&iconColorHeader=1f1f1f&bgColorContent=000000&bgTextureContent=gloss_wave&bgImgOpacityContent=55&borderColorContent=4a4a4a&fcContent=ffffff&iconColorContent=9fda58&bgColorDefault=0a0a0a&bgTextureDefault=glass&bgImgOpacityDefault=40&borderColorDefault=1b1613&fcDefault=b8ec79&iconColorDefault=b8ec79&bgColorHover=000000&bgTextureHover=glass&bgImgOpacityHover=60&bor

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\trontastic\theme.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (1371)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):18012
                                                                                                                                                                                                                      Entropy (8bit):5.093213207857892
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:XQpY0Po/ActF5fyxxFzEcvYPPANNPmgmB0iBfT9RhS2wV53skuMaaSQhQz0iIhk4:XudSF5fyxHEnDS25gTv
                                                                                                                                                                                                                      MD5:B9372C0BA160BF67375785C6AA74BEE8
                                                                                                                                                                                                                      SHA1:DC904367D60386F046664FD0ABBD46860F36E406
                                                                                                                                                                                                                      SHA-256:0F740482C84A149635F253557D58CBBFAE95F19161722725BCC54D72DB0E3E3F
                                                                                                                                                                                                                      SHA-512:602214B0CE53517AF6AE45E746A7C1D77707531E6EC10CDE51B9D8A85E21852F692E4258F8D81A86F750D6F30DDCF7F67EE3B7E36FDC2485CEC2D4D119CA3660
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CHelvetica%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=9fda58&bgTextureHeader=gloss_wave&bgImgOpacityHeader=85&borderColorHeader=000000&fcHeader=222222&iconColorHeader=1f1f1f&bgColorContent=000000&bgTextureContent=gloss_wave&bgImgOpacityContent=55&borderColorContent=4a4a4a&fcContent=ffffff&iconColorContent=9fda58&bgColorDefault=0a0a0a&bgTextureDefault=glass&bgImgOpacityDefault=40&borderColorDefault=1b1613&fcDefault=b8ec79&iconColorDefault=b8ec79&bgColorHover=000000&bgTextureHover=glass&bgImgOpacityHover=60&borderColorHover=000000&fcHover=96f226&iconColorHover=b8ec79&bgColorActive=4c4c4c&bgTextureActive=flat&bgImgOpacityActive

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-bg_glass_20_555555_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):318
                                                                                                                                                                                                                      Entropy (8bit):6.008561760794062
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPh8TUyKOkSrnLTR6MoHkyvzgN+Em6hp/KEMlOZp:6v/7JSUkrnLTR6BhvzS+Em63KEMlOX
                                                                                                                                                                                                                      MD5:11F8721561696E039555A6D2BE1A53A3
                                                                                                                                                                                                                      SHA1:2F5CFF5D9045BCDB1C28F398B5109A51DD30F0E3
                                                                                                                                                                                                                      SHA-256:D3368B948E231CCA6EC8DCD9510FFCFB47EB046E9FB004C624523131EE5DE19A
                                                                                                                                                                                                                      SHA-512:C13D384DE63CFC653F0F98792DAA6C9D2E0C8A9D375912CFF5660F034A1BE32A60A0A2C8C5203AA9F2866024D65FA71B54D3C7E3D699586D5CF3144D5C1E298C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR................D....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."....!...FIDAT8.cH....0.F....H..{LL&L........11.ebz..t......X..h..x..Ai..<.....2l....<....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-bg_glass_40_0078a3_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):400
                                                                                                                                                                                                                      Entropy (8bit):6.518893987171985
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7J1r+U9+NoYrIYYbfeZ5gzS+Em63KEMlOX:krr9+NoMzOzjEmdEMlOX
                                                                                                                                                                                                                      MD5:6DF465DE070D719123DA33EABFD7F871
                                                                                                                                                                                                                      SHA1:79C190E2E58B352CD16E41F42C5579D900C44014
                                                                                                                                                                                                                      SHA-256:F4421025C0749891BF5259ACB8EEF0FFEDEB16364544921A363318A703F38291
                                                                                                                                                                                                                      SHA-512:FEA771E97882FB6E09F6FC4475F404CCBDF5AFC6ABB41182C45A9DA55168845964C13AB80762582C997CC6D301014AE08AB6B7D4B95EA82F1CF52AFA06011075
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATH...1..Q...{.....Pa......;.0.uP)&..=.Uf.*Q(..N..J....V_.''92xn..."""..8..v..#E.z...@..B..kB...ZIE2.3....6Ia.-bJIE...m.D..c.1[.X..B......8....!.(gc...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-bg_glass_40_ffc73d_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):374
                                                                                                                                                                                                                      Entropy (8bit):6.401625747553546
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPh1r+UyKfp5EuP6rs3grEM5E7e+Vn0g2zgN+Em6hp/KEMlOZp:6v/7J1r+U9+JrTFKe+J0g2zS+Em63KEZ
                                                                                                                                                                                                                      MD5:FC8DF1573F4A44A8C6C1A6C10D3F2CBF
                                                                                                                                                                                                                      SHA1:F520333BA8EF9554A754CF2E064C9FEC8E71C925
                                                                                                                                                                                                                      SHA-256:5BD93AE714C82077AAB1B1171816B39514003788BEA55BAE3CB2CF27CF2925FA
                                                                                                                                                                                                                      SHA-512:AB275E4F6BC5F5BB188FB174388927B2C9E4578943859ABA48F73A6FE74CB29D1F3BF4B05B4562236EB85A6349F3C9D8A611507252DCA6E64DFAA43597C17F0D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!...zIDATH.....@...}.......f....&..Zh..&..:i.N......O.Z..~kZ.@..A..^.....3..AcZ.TRc.&.....T.A...k..U:...'.z_...0....6..`f>.....A.....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-bg_gloss-wave_25_333333_500x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 500 x 100, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3976
                                                                                                                                                                                                                      Entropy (8bit):7.8903193220578425
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:ftf/8ADvO3/zZmSxLHgjyFaJxuf9ZaLDnAb:1sceHZnFaHufjaL7Ab
                                                                                                                                                                                                                      MD5:06CF28ABF236C7E905E03E79C54C6196
                                                                                                                                                                                                                      SHA1:00A5237473FAFA2FA1B5C9BAE9D3F5229928B4D2
                                                                                                                                                                                                                      SHA-256:711D5BFD6EFBE4159B9316AE37B97C6597CC20BC41AA17B5D8FE1F41515BBB27
                                                                                                                                                                                                                      SHA-512:57CDC25EFBDA108C1E5FC79D73F3CDE34030CB1BB7494BAFDB5FC07A5DFCE1600B9332153A94C73E150FE1D3FB518ED72945A1E89F4FF87F26CD9518C02F733F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d......<A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."....!....IDATx..]K.....,../.u..K3..a........o......{..)Dj.xa...|....,..EfVukZ.|..jV~..J.#..... .G..C.@...Nt...8..b..D'..... 6.Nt...8..b..D'..... 6.Nt...8..b..D'..... 6.Nt...8..b..D'..... 6.=.'.i.O...k'S;)......#..2r.t.q..z....q.&..Zar|4..%.G..H-...Y~.c.V..5_#.Z;L...l0..f.F.e^m....."~Qk?Fb....~.d.b/M..lZ./.!.A<r...(.Y..f...6.:..E.K..k.4G`.1..V......J..z..s.....tL.d6B./...k....CA..I.].h..c...(.:.w#.+....A...7...A\1.u'..... 6...d..5.?.$.L"2....._.7...b.9Q......,..+Y[.K..V.)..:..H.TZ.JKB.v.U"....B{H=......#1.......>..G.Gy...x.#...6.....a...i0.. G.4..[..7dG-.$"R....E.q..ocue..?."e../.K.R.K....K....n.BI..-.U..Cs.44.U.U.(....Z...&.2.....k.V~/.....=.e...=<4U?V4.=..5...4.....\..m..v.........n.r.....#A.6......1...I...!..Qw.....#..... 6..3S^...B... 6....b....?.H..}...x......Z..JG../X"...R;z.y0.L;.....t..M..$(.#..T.>t...V=6.}.]>..J......u...=..I5...y

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-bg_highlight-soft_80_eeeeee_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):335
                                                                                                                                                                                                                      Entropy (8bit):6.113278669095229
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPedUyKOkQravt0CSSZq1ekAYUlr2zgN+Em6hp/KEMlOZp:6v/7WdU5fSSs3A1gzS+Em63KEMlOX
                                                                                                                                                                                                                      MD5:EEC6910145DAFFE21C779AAA9C255047
                                                                                                                                                                                                                      SHA1:488063F1C1337971EE1166C864A34427BE063D91
                                                                                                                                                                                                                      SHA-256:F45D9C0987A11738442831BF78EA54D622FD8DE3000B0C5D9D3D1E79087FBD92
                                                                                                                                                                                                                      SHA-512:0F3085AA60EB013004674E91A3574807F630B47AC1B1852F4DC1A2FCF29CC39748004A69D07003C8B4AA565789B0723367581ADE792040AC2544EC50C637B570
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."....!...WIDAT...1.. ........v0.......8.......W.8s..<.NPE......!.<..IEL......M.\.0..N.%4x_k...-1..W......%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-bg_inset-soft_25_000000_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):312
                                                                                                                                                                                                                      Entropy (8bit):6.034147603751223
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPedUyKOkgkblqwtB5W7Kf2zgN+Em6hp/KEMlOZp:6v/7WdUnBq+E7K+zS+Em63KEMlOX
                                                                                                                                                                                                                      MD5:5F96013D83CA38E61881FBBF84F1BD01
                                                                                                                                                                                                                      SHA1:F7F8FFF3D39F148DA1A4F2B95CCD19FB6E05B0FA
                                                                                                                                                                                                                      SHA-256:67A5436E917759B5CA0965A74C3D603AAFFB3E36916A907F46DD6F3A3354219D
                                                                                                                                                                                                                      SHA-512:3205093B7FA0C4E3926B314B0627B209FE338E7F07E15D9BE574A52F6B6C13FF0DAD7F8E407D557FAF0A086F5D29C2D2E6B807FA61897D92693E399364794A76
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."....!...@IDAT....1..0.....@F(...eH{.....P......n4M......I)l..Fc.zH.>......~.....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-bg_inset-soft_30_f58400_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):398
                                                                                                                                                                                                                      Entropy (8bit):6.600503268336194
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7WogU9+2XOILd7nEJIzS+Em63KEMlOX:no19+2XnR7EJIzjEmdEMlOX
                                                                                                                                                                                                                      MD5:F97ADA5E876AD704AB2B72740A4FE25A
                                                                                                                                                                                                                      SHA1:E3B4B8D5F26EECB796E312B0F7CBF4E9F013BD45
                                                                                                                                                                                                                      SHA-256:BF98648A0DB139C7646766F107FD470CA0E18FAF90AED120B6428F07F8D83AFD
                                                                                                                                                                                                                      SHA-512:6C3776E29DAAEBCFC07E41F7CCEAB7C811F3BE45AF0DABA328BE3B887A606E05BBD289E81CDCB2952224086BA7E7B86E03D60E6FF8DCC47B536B30AC01F0B616
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDAT(....P.D...B.".HB.Z$.c.k.;W08..Xd..!.......V...q.....|...?>c...x..[....%.h..s*...2.P.8....+*\.8y95..n....p....g.;J....u.h5...w.~.x.......6...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-icons_222222_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7025
                                                                                                                                                                                                                      Entropy (8bit):7.929805003010536
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:IcH5ZfLGSAsNh7vB1PP0M6hPmBmc8aWkRwP4:xHjLV9b7vbaxNcbdKg
                                                                                                                                                                                                                      MD5:23ACA9C182696DB96FF9EE5BF9601461
                                                                                                                                                                                                                      SHA1:F2FB72129DB2BA61E5E9E572B24D82FB93ACC3F4
                                                                                                                                                                                                                      SHA-256:28D8B65FD4815EBFFB752BEB60B976D22E8BD4004194B8CFDD0E9A14E39814BD
                                                                                                                                                                                                                      SHA-512:F36FE89779D9EEDD2456826125166428824ABD33C999B187F69F976F51A5FAE7A2B286B44C4312B7B920BDBE0F043EBB652723962267489EB0B575EB5179FEC0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD."..b.....tIME.....%...'E...TIDATx..m.%Uy...$.!,h. ,.%..&...@.|I..E.M.r...D.....2;.f.....A^$5...j^.K.@U.....-.wW...D`..|.q..".t>........3}.S...~.9}.<.>..<.yNp..M.)....`...px..h...t%....y.Y...D.^.`..O..r.%`.:.$%...{.....0L.L..?..a|..6.....]A......7P..'@/:.]5JH.&.ay.......2....:.8t..y.....@.....#*'..?..t.;.Yw.m..........{.>|Dg7..\J.{.4..K.......3...t.f.Z...`.7.u7..Y.~f].<.....4m.*..<.%%...{.^.`....FR........l8<...O........h8<...O..........k.2..n..6cL...`>.]=u........$....,`.&.+h..k.6..J_*|.K.0...?@..lx..do..m.]..L.3...0.;......T.E,;...4......t...MO...mP.L..U.A&......e...+..`...8u...].5.7.7.~"....h8<...O........h8<.....]..C8.Y..s....Z..}i.A. ...).s.W...!.m.........z.[.#...R.....\R..{...v..........r.....R.. .?.#..[.|.f....`.........y...).A...-..Q.N..4w....:Kr{.......3...Z.P.!0t.{l.\.Y..wSn.P.IA..Vm..-.R...$y.....sI....@;..e.X...v......Y.v...B....n]g.......W..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-icons_4b8e0b_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.7718687501842405
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:mNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:YHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:853C2373C51B7B7C545D092D4A98B3CB
                                                                                                                                                                                                                      SHA1:12270D908EAF7EC8C1D3491C4BFB00414911ED38
                                                                                                                                                                                                                      SHA-256:FA33C9FAA259211591EA1C144246F1CB01B3CB18FD739FFAAE0A4965B979FF97
                                                                                                                                                                                                                      SHA-512:89CCA39CACFF95B8DE1D1C29B8587EBABB91FCA2F91EAE1F491F3410C7549981E80FBCD188AF7DB63DF94ED7D2BCD301082C50E01B171308F76931EB2CD574A1
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTEK..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K..K....]l...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-icons_a83300_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.745691045674909
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:PNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:nHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:372DD47E50840F48E9098AA30D978A5D
                                                                                                                                                                                                                      SHA1:49F2C2A59C0A53F5400BC19F2F66E516699CDF74
                                                                                                                                                                                                                      SHA-256:5D119EC862AEC3BE0B0722B651C5FEE065AB8255B0DDAD3D01E1A6B929B7DFA8
                                                                                                                                                                                                                      SHA-512:9E24AAE1EE5750587C76145C557117E51A04E4B8EB0A56A4C2A88F11808118E2B33575B25AB2AD062A1B5862DFDFA7EDA2B11F5D15C1CA3DF9927D7DB81498F8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3..3....g...ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-icons_cccccc_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7034
                                                                                                                                                                                                                      Entropy (8bit):7.932139241999848
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:K6OJJxfX8+p4/rF1km/zUCVbGarOXZuphvgXad4:K1JJxPzkFWm7UJZOJgqd4
                                                                                                                                                                                                                      MD5:883030509884C748B039641F5955E85C
                                                                                                                                                                                                                      SHA1:FA1BCF0D7310168CF3DD77A30CB527A31EEB6D5C
                                                                                                                                                                                                                      SHA-256:055799E2F20C94BB0CD60D6AFB71D362DAA66AAE390032AB03C631C92FEC1860
                                                                                                                                                                                                                      SHA-512:830C390394294C460D177FB4FC0D714D05994EAC8FEB5AD98C42876F204C8FE51983C31536C84B3DD6D8DC172E24555BA06E64EFB0BAC60CB3C5C4BFB7235814
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..8_......tIME.....%...'E...]IDATx..m..Wy.....(..R.....%..H.&.x.D..Er.....(.....D..........R....H.R;..H.]B......P.)mIX.b.R.*Ed.a^...w..;...{..s...sf...._..8k....,<...O..mB...F.. .6+.J.(.k....i.V....EG.$.......`....c........al.N..Z..._.)`Jy...<.z...B.7...N\..X.V...).)..!H..."&...!H.G.NP)~r..o.vX3.)...........{.>|DW75.9.z..i..\...2..g..w....*..cO.|o..n....m..By.....j.T&.y.JR.|.{.^.`....(5........l8<...O........h8<...O........:...2..n..6eL.h.`...y......Q.G.$....4`.*.7.^.k...R..>2...=@..lx..o..m.]..L.3_...0N;.......c..N..:...t..0..ny..'.Z....@.e.I.:...&r.....^.l..+..=.........O.5.....'@....px.4.....'@.q.30t..8._...t..../.0.....TW..c.......Q.... . )....?j......Uc...%T..g..l.......8T.K.B...%..A&~..F"....f....`.........u........H.(Z'.a.;PJ.WW]%...y..rs.Y..A>...}.....[(.vV....7pH..@..V...-...$y.....s.....@;..i.X...v.....Y.v...B....n]g.......W..c.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\images\ui-icons_ffffff_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):6487
                                                                                                                                                                                                                      Entropy (8bit):7.90376532755891
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                                                                                                                                                                                                      MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                                                                                                                                                                                                      SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                                                                                                                                                                                                      SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                                                                                                                                                                                                      SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\jquery-ui.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2363)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):36634
                                                                                                                                                                                                                      Entropy (8bit):5.280309221019183
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:10OW0CQ8yBb6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHoPSp:p84b/+vaW1e075F5fyFE+DS25u
                                                                                                                                                                                                                      MD5:6A4AECFE4B9DD31564F28C2EE7B26DEC
                                                                                                                                                                                                                      SHA1:DE0646DA25A11C6D4A853AE9B82C08EC3F2689EE
                                                                                                                                                                                                                      SHA-256:46F68E72374A75AEA582DA3483B9E7E92730C1D1CA664FB44A4A8120C0766D39
                                                                                                                                                                                                                      SHA-512:8471611D9A020AC06A0B827F3B9B2A8018F03741F6E4814B37C982BFCE34EE8750BF66ABB908390B7E31A4AC1B6316789BDD6A04116A0036156CDCC3459EA17A
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=333333&bgTextureHeader=gloss_wave&bgImgOpacityHeader=25&borderColorHeader=333333&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=000000&bgTextureContent=inset_soft&bgImgOpacityContent=25&borderColorContent=666666&fcContent=ffffff&iconColorContent=cccccc&bgColorDefault=555555&bgTextureDefault=glass&bgImgOpacityDefault=20&borderColorDefault=666666&fcDefault=eeeeee&iconColorDefault=cccccc&bgColorHover=0078a3&bgTextureHover=glass&bgImgOpacityHover=40&borderColorHove

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\jquery-ui.min.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (29572)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):31354
                                                                                                                                                                                                                      Entropy (8bit):5.223226346217589
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:p84lcR8lOXHc11evqWhzkmV+446GpbZ3Sc7nfZBhVz:2XHcEqWhz1d46GpbZZBht
                                                                                                                                                                                                                      MD5:237B0C1A24AA2B71B678651FC1933EA4
                                                                                                                                                                                                                      SHA1:6F9BDD141DCD877D3F0FB66EB9EDBC9F04CA2BC7
                                                                                                                                                                                                                      SHA-256:40E96918B8202A37FFC43EA78515473948913B9C6F224F0911D19A6B8C893C9E
                                                                                                                                                                                                                      SHA-512:C2E28348BA0534B44DBE384925AA39DC6D0051B333667EBCFF5313E8A8880C84AA2C112EE3FE70A63256F44989D5F1204D577F2CFF0287CAA4B58DD154CCD187
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=333333&bgTextureHeader=gloss_wave&bgImgOpacityHeader=25&borderColorHeader=333333&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=000000&bgTextureContent=inset_soft&bgImgOpacityContent=25&borderColorContent=666666&fcContent=ffffff&iconColorContent=cccccc&bgColorDefault=555555&bgTextureDefault=glass&bgImgOpacityDefault=20&borderColorDefault=666666&fcDefault=eeeeee&iconColorDefault=cccccc&bgColorHover=0078a3&bgTextureHover=glass&bgImgOpacityHover=40&borderColorHove

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-darkness\theme.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (1359)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):17980
                                                                                                                                                                                                                      Entropy (8bit):5.084298001320604
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:XQQ8yAPStd5hYgF5fyQPzH70EcS1poqZGgmB0iBfT9RhS2wV53skuMaaSQhQz0iu:X38cF5fyFE+DS25u
                                                                                                                                                                                                                      MD5:D9952DDC64DD30C26F4F30685D7E07F5
                                                                                                                                                                                                                      SHA1:F4DCBB31D47FA4E7C5A74BE86AF5CBC6C3905073
                                                                                                                                                                                                                      SHA-256:A4B7629CBF15E6A2551F5BB0CFE25C501822BB59EA507B6FC2F8A3CB3F722CE6
                                                                                                                                                                                                                      SHA-512:C30533286DA4ADAF46678A0CBC9534A223CA519993A19287A4D21991CCC0A981D8FF5039A391DBB358D68326E086015B4D3E07CB543EF56B1B8035666ED590EE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Segoe%20UI%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=6px&bgColorHeader=333333&bgTextureHeader=gloss_wave&bgImgOpacityHeader=25&borderColorHeader=333333&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=000000&bgTextureContent=inset_soft&bgImgOpacityContent=25&borderColorContent=666666&fcContent=ffffff&iconColorContent=cccccc&bgColorDefault=555555&bgTextureDefault=glass&bgImgOpacityDefault=20&borderColorDefault=666666&fcDefault=eeeeee&iconColorDefault=cccccc&bgColorHover=0078a3&bgTextureHover=glass&bgImgOpacityHover=40&borderColorHover=59b4d4&fcHover=ffffff&iconColorHover=ffffff&bgColorActive=f58400&bgTextureActive=inset_soft&bgImgOpacityActive=30&bo

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 40 x 40, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):476
                                                                                                                                                                                                                      Entropy (8bit):6.801036804973001
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7egU9+8DW7LM/9+RR7/r2zS+Em63KEMlOX:X9+DLM/20zjEmdEMlOX
                                                                                                                                                                                                                      MD5:AEB4E9CB65DC390A7596D0F9A7372DB2
                                                                                                                                                                                                                      SHA1:8EEBB6CE0A519300484787691BC4471550386FF0
                                                                                                                                                                                                                      SHA-256:E8B26C78D61686274193C20EBE7D328E58A307E1231BB01C60001FD6D54F506B
                                                                                                                                                                                                                      SHA-512:D44C4A994FD3BA1ACB33F01055CE171B7790508B0039A87CC070B1D12E5EF16D421F143EF1F650D1FEC167E092C46EA3AA84E297C165F3D2372BE7F52399E46B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...(...(.....S..y....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATh...1..1.F..6^@.-....y....'.k.Z....@.d..y..d...L..O..~2z_...}r.9oo.7[.......R.`65..@Ui]...-"U...q....G....fP..$j...`*..fS3p.T....HT...K......:..q.npt...6.I...G5.Tj..f...j...S..$j...`*..fS3p.T5vZ\..i.npt........h.p.....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-bg_diagonals-thick_20_666666_40x40.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 40 x 40, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):384
                                                                                                                                                                                                                      Entropy (8bit):6.488096122297592
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhP0CUyKOk4k55zD4o/qJjnauLAvxxMPNvzgN+Em6hp/KEMlOZp:6v/7MCUf55zD44gTayApxMVzS+Em63Kk
                                                                                                                                                                                                                      MD5:490AC31FA93F68F9292323E037937BEC
                                                                                                                                                                                                                      SHA1:C2721F24EB7F4DFF9254F173DA245F826E2EBD62
                                                                                                                                                                                                                      SHA-256:D62EBBAA1B9AFE2ED31D82593110EF740389CDCF12D740AC31E4018AEB43F86F
                                                                                                                                                                                                                      SHA-512:2E780F8A4FF5CEAA7AC8826E9D4FDFAF77B2A8253A93826610021EC6B059CD86D7E523F35D2F55CAD718ADABC0D3252F1DCCCF2EAFC8EFE4DAB4BC51E20E7AA8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...(...(.......;.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."....!....IDATH......0...g...8.W7.dn.../..RD...w......8US...].....5..*.q....n..u..p%.......Hp..p....r.d,'..M>..K...dC.0..@...E......os.)?..K..........%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):324
                                                                                                                                                                                                                      Entropy (8bit):6.0982059449840005
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPh8TUyKOkMklPzwIZw//aLZ2zgN+Em6hp/KEMlOZp:6v/7JSUTlPEIKHDzS+Em63KEMlOX
                                                                                                                                                                                                                      MD5:AE9CF02A88E37C02A866DAB3E4290554
                                                                                                                                                                                                                      SHA1:994C07B326B659E422BA1E7FA898448FA31B495E
                                                                                                                                                                                                                      SHA-256:7824BC7887AA24A3CE2669DCB8B1826852DC7092BAC93ED150EC3772DBD7DA15
                                                                                                                                                                                                                      SHA-512:4D23AA236034FDED161E2713CC921E56155877AFAB93B1C711A1E3EDD3263845B0C7BF4C0B1FAF70F3679C5A4B37C22E2A5D50CBDFD7D17E2B1E1F1221FE216F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR................D....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."....!...LIDAT8.c.5...a..".".o...K11.1|?..C......b.?.2..ab(c......."..%&.s&...w.(.....r...J.W...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):406
                                                                                                                                                                                                                      Entropy (8bit):6.56964676945079
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7J1r+U9+yKIfwBpTzj4J6qlVz7zS+Em63KEMlOX:krr9+1IfwBtz66qlVz7zjEmdEMlOX
                                                                                                                                                                                                                      MD5:9A6AAE6A95E61B968FF869599BF14C1E
                                                                                                                                                                                                                      SHA1:9551A9128C38366AB8029B3C263B4941483C265D
                                                                                                                                                                                                                      SHA-256:8E15C1E7A06A156139CF1C42576CD2625AE9D5870CD4088B4CACEFE22CBC724D
                                                                                                                                                                                                                      SHA-512:09E221A7689CD91D7B6CCD4C2FCD1EFE8FB0E7A45A792C62B3CB846B7A7B10E42EABE8780752F7EA918D574EB473826001CB59B253DBA8525C060CB5077FB68E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATH...?.........H&]..(..v_.W`5_Ym....F........t.?....;=...eY<#...a..AY&I.R...h`.5.`........u8FD[..9t.F'.pe......z..=...W....].{EpK.:......_...0~....2UE\.....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 1-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):265
                                                                                                                                                                                                                      Entropy (8bit):5.620668247500632
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPh3EUyKO0kIojl2XIzgN+Em6hp/KEMlOZp:6v/7J0U0SXIzS+Em63KEMlOX
                                                                                                                                                                                                                      MD5:ED31481B45167E6F49FDCB1499911BF3
                                                                                                                                                                                                                      SHA1:4C129F32CABDF52B0EAE217A30360C3571390986
                                                                                                                                                                                                                      SHA-256:15470C38D6F3194815FFCB9CB182EE4AED0C4E0839B7B5AB0A5FC1C6ECB67C63
                                                                                                                                                                                                                      SHA-512:7C0199CF2FFB71B0CD5348E7171AC0E2263EBBB92EC8F4C8C659EDA552FAF1B0A34B3263DE0F044360F50E86DDB3CEA23F5CE1C63AC2C514789C58399397A0F2
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............G#7v....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME....."....!....IDAT(.ch`...p....h...4.i...%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 500 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5873
                                                                                                                                                                                                                      Entropy (8bit):7.6864989393853715
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:fHCKpHEgefVb6uUwreFh/nDA+nwSmhOuP+0G9rEDq6b+6LyRAOiZcuWqPkD7MmMh:PCK5Egetb6uxG79whOumoD9q6LoAjZ7B
                                                                                                                                                                                                                      MD5:437D053C3D8E0491DB75537CFAC2A614
                                                                                                                                                                                                                      SHA1:CE6EADABE70270A7D8655BA847851C42B722EDBC
                                                                                                                                                                                                                      SHA-256:A189DE8FE3307A4E2613B1FB3B57C68B2083EB8A9F76984E7A290363799920FD
                                                                                                                                                                                                                      SHA-512:AD777191DBADFD2B8F1A569E7B4400FAB8566BC3FB9F2297C713E631130B9BBF965B8DB15F97FB85D70C045BCCB90623F1DA406C8148B74A8FB361796FC7FF8E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d......5.i....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDATx.._.g.U......LT..T,..`.....JI.<T.....<..V..Z|.D.e..`..$....g..p...&..%...|.36.'.P...0.{|83...w...............k}......ow..w..........6..u;......7..;......`......0.......L.6.........;......`......0.......L.6.........;......`......0.......L.6.........;......`......0.......L.6........f..e..worE..jc.^b.....:n..P...F..y.yu.-.d....^.....Z.3.W......M...fS9y..k9u.[.z_.7..s_..\+..%sA_m..x..Ea/..k}..X.@..y..}....#..{.c.*...?.6...?~...}?3T.....X..We..~...M..')k.(.U..r%...y_M.m..^e..v.V..r..f.WC.X...ZuXbm...e3/.y.........:.Q.....S7......G.uU.T..dvx#...^.y.x-G.......UA&.....h.<,....t.....H..2........;.........a..5..vw....q=...Gz.[....vn....W...Ji....].YWR..^T}....R.....:Q|.RRo%....YV.+s....j.=..U..nJU..)k.R-...........F.W..N...==..X...j..%o.5F......x..,..d6/..J..^.......U..Sa..e....+..1..c......m.).^.q.).S..:....S<.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-bg_highlight-soft_100_eeeeee_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):342
                                                                                                                                                                                                                      Entropy (8bit):6.2013416841671685
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPedUyKOki64dcmi5ukzUqmiGWDQ2sxzgN+Em6hp/KEMlOZp:6v/7WdUE64dcUdiGE8xzS+Em63KEMlOX
                                                                                                                                                                                                                      MD5:D4FF4FB8DD6E2BD2DA63DB2AD6F4AE7E
                                                                                                                                                                                                                      SHA1:9CCD0C1300ABB0EB5909F1A7EB725B163FE545A6
                                                                                                                                                                                                                      SHA-256:E8AE5A6A366AD82330ADB5C9A2ADF03C61584B8BFD3D56020BAA5CDBE2F42946
                                                                                                                                                                                                                      SHA-512:58341C7E93A2DF919B8EEEFFD29F0FF8DA3714029A8B14A7A4A230EB9A2B18DE88C650C1F0C4246699FBEF7E6ADE520E275307E529178700980F2E6385CCDD63
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME....."....!...^IDAT..c.....@.....Q&.U.?$..ob.n...0.7o.....Z2|Y..E...\.."L...>11./g.....&..%..g..f2.Wdx..^..... ......%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):386
                                                                                                                                                                                                                      Entropy (8bit):6.581871885288079
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7WogU9+ihDVtRYJy/2zS+Em63KEMlOX:no19+ihDVteMezjEmdEMlOX
                                                                                                                                                                                                                      MD5:8CBB1D31D59A19492034887A9727BC2D
                                                                                                                                                                                                                      SHA1:A4A20C32539CDA455982CEB86BAED3571B742845
                                                                                                                                                                                                                      SHA-256:0BF4E921028BDB28B10133B4EC93C298E18AC8E11181A3DD12645CF8A0B9F814
                                                                                                                                                                                                                      SHA-512:B3F84BD0E92108AEF3F98A7BA6880590C404195D3A7E500F58DD918D81B614350927C4068379873FA4069D598B967D4132DB5B1C1645F2CA96706E2E03410A85
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d........t....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME....."....!....IDAT(..1..P.D.SZ.6.M....!r.....K.J....F...f,>Ao.`.x;.,,.cs....p......>.uQ`.i%........S).~.....rV..=O... p..l...:]....Z......O....?.q.|....%tEXtdate:create.2016-09-14T13:34:08-04:00_Dn....%tEXtdate:modify.2016-09-14T13:34:08-04:00........IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-icons_222222_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7025
                                                                                                                                                                                                                      Entropy (8bit):7.929805003010536
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:IcH5ZfLGSAsNh7vB1PP0M6hPmBmc8aWkRwP4:xHjLV9b7vbaxNcbdKg
                                                                                                                                                                                                                      MD5:23ACA9C182696DB96FF9EE5BF9601461
                                                                                                                                                                                                                      SHA1:F2FB72129DB2BA61E5E9E572B24D82FB93ACC3F4
                                                                                                                                                                                                                      SHA-256:28D8B65FD4815EBFFB752BEB60B976D22E8BD4004194B8CFDD0E9A14E39814BD
                                                                                                                                                                                                                      SHA-512:F36FE89779D9EEDD2456826125166428824ABD33C999B187F69F976F51A5FAE7A2B286B44C4312B7B920BDBE0F043EBB652723962267489EB0B575EB5179FEC0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD."..b.....tIME.....%...'E...TIDATx..m.%Uy...$.!,h. ,.%..&...@.|I..E.M.r...D.....2;.f.....A^$5...j^.K.@U.....-.wW...D`..|.q..".t>........3}.S...~.9}.<.>..<.yNp..M.)....`...px..h...t%....y.Y...D.^.`..O..r.%`.:.$%...{.....0L.L..?..a|..6.....]A......7P..'@/:.]5JH.&.ay.......2....:.8t..y.....@.....#*'..?..t.;.Yw.m..........{.>|Dg7..\J.{.4..K.......3...t.f.Z...`.7.u7..Y.~f].<.....4m.*..<.%%...{.^.`....FR........l8<...O........h8<...O..........k.2..n..6cL...`>.]=u........$....,`.&.+h..k.6..J_*|.K.0...?@..lx..do..m.]..L.3...0.;......T.E,;...4......t...MO...mP.L..U.A&......e...+..`...8u...].5.7.7.~"....h8<...O........h8<.....]..C8.Y..s....Z..}i.A. ...).s.W...!.m.........z.[.#...R.....\R..{...v..........r.....R.. .?.#..[.|.f....`.........y...).A...-..Q.N..4w....:Kr{.......3...Z.P.!0t.{l.\.Y..wSn.P.IA..Vm..-.R...$y.....sI....@;..e.X...v......Y.v...B....n]g.......W..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-icons_228ef1_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.758680832020893
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:LNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:bHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:A9245423A8C7BDEEF75E74AFB9AA4F2E
                                                                                                                                                                                                                      SHA1:5ACD9E5ABF06E470FE3AB6CA2C68928D73AA419C
                                                                                                                                                                                                                      SHA-256:82657B8AF718436B5035B97B0680DB73BC71A49E6E85E90060333515DB23CB42
                                                                                                                                                                                                                      SHA-512:B54475A9F9690E0D907B6B627F61E36C934E8680D594990998A33A756A3D79D9659D3FA7473E0303A179EB32123681BA049A8760CFA8152994748104ED17CBB2
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."..".."....*....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-icons_ef8c08_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.773765613279426
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:6NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:0Hm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:5D1760802B4EBACA262C99F2E4C99E9C
                                                                                                                                                                                                                      SHA1:A7194E4F70B0AF78478D4FD87996EAC871AE1B0F
                                                                                                                                                                                                                      SHA-256:B68FBED9DB6CFDB2E895A583D02D70F84E3C6BD79DD6DF7D6CE4E269314649E1
                                                                                                                                                                                                                      SHA-512:86F67F4EB53B85852964CE98B81FA4608AC319F14077865FF5E9ADBB58BAB686C4F805B90ACD26D026BB2075349668EDC65AF09AFA0CBB4F977C3641F530A1DD
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE...............................................................................................................................................................................................................ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-icons_ffd27a_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.762337567109736
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:/kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk4:/kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkY
                                                                                                                                                                                                                      MD5:B1395D7A2A3288A98F8228E1EF360EC8
                                                                                                                                                                                                                      SHA1:F9BC509291C758D04AD0EB9AEE287BF339C7EEC9
                                                                                                                                                                                                                      SHA-256:0FA74A430333176F98075CCF436E33A020307586C76493C60B7F6FB111C1DCE4
                                                                                                                                                                                                                      SHA-512:807401A623909AE49A0553D552C44C2F2C6A2A73E385C305F3989E7725BB2D124942325CD7293212B94D669B760675EA416F9687DD78869972231CF605BD6AD4
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z..z.......ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\images\ui-icons_ffffff_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):6487
                                                                                                                                                                                                                      Entropy (8bit):7.90376532755891
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:7j0gQaKWsGJ989aEOJ4bKSbfHdx2p1oAvqAxh+:7Igz9tEOJ4bKAPmZvqAb+
                                                                                                                                                                                                                      MD5:2E2A588883EEBC04AD50854A6ECFBAC1
                                                                                                                                                                                                                      SHA1:E457B4C6EF4C18513E3BB6F81E873592DE31F0C5
                                                                                                                                                                                                                      SHA-256:357F4D62C6F7AD56F7CAA72029362379ADB4A1A48F33F43F226B1284474FABDB
                                                                                                                                                                                                                      SHA-512:EDAC3D55EE5491E6EDDE4C5DB11371C47BF47F976DE3AA493B78A5BCDF33992C4E28CAF56288780FB96C35896448655305E8CD33E94082034951DB3D7A032F34
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....%...'E...:IDATx..]m.].Y~..)*..|.&q...4.!K.K$..d..k~.....#>..u....n..?.v.BR.i]9.?7.Z...?XS.T.1....8.j.C..Oi.."...k>..8.....<..{.yg.....9g.wfNB....F]...". pD.....u!....":X......M.._?..}.M...&..9.......CD..!..5N.".%}..c.c?7.i.5...<..6.z...!@..<..yZs......S.w..:n.P...(.^z...w......6.z..(...........n%s-.@....?....sp?..........F.4.....:..F]...$..$t...X.u1.....#Z..G$@........#. pD...H......iG]...f.ty..im..J.Z.|.....|../2/..2.Wo.7..9.r...m...*]]oe^....r7..&...oJ..]\...@..v.l.u>...^........k.......C.f......9...s....`.a..t>....!...G4...H.....8"..G$@..........Q.`.@HFx....P..w7K>.F.e..Y.TIu..N9......B.....Y.j...{.W.S.'.\....>.*..%EpU?.9}..@>U0_.>......Y..........D..."../..|.O......t.6...MJ@E..g.._^.2.En....2.K..U.....q..ag.k.O..G.6...[..l..O..6..U..e......@7..y..X...u......Y.n...R.Twp..}....8. pDK`........#. pD...H.....8D.t@...h..p..i...h.t.z..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\jquery-ui.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2363)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):36796
                                                                                                                                                                                                                      Entropy (8bit):5.28435402116626
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:10OW0k3b6l2n+brGtUQnSMfps3+eYQY+h572hk//r8Y5Y6BjSmMErEURHs+jVLlB:A3b/+vaW1e07BF5fyKEUDS257
                                                                                                                                                                                                                      MD5:B7D9243F1C7B74709FCBCD7DFBB75E6A
                                                                                                                                                                                                                      SHA1:6A89350F9A730ECBE7E3A605D24BA3CF86E03D55
                                                                                                                                                                                                                      SHA-256:722982F556E40891116448DE1B410EDF8D448ED51E4D3EE00081A8D9E1DD72BC
                                                                                                                                                                                                                      SHA-512:C6683EA031F7391C9DAC3EB0080B29C1AD327014C2A29385A30914CBE0BDC69F3A1C5DBA5C994941829D3BB92362B4FF32BECEC695AEB88A23B0C61B0BA13AF3
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CTahoma%2CVerdana%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=f6a828&bgTextureHeader=gloss_wave&bgImgOpacityHeader=35&borderColorHeader=e78f08&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=eeeeee&bgTextureContent=highlight_soft&bgImgOpacityContent=100&borderColorContent=dddddd&fcContent=333333&iconColorContent=222222&bgColorDefault=f6f6f6&bgTextureDefault=glass&bgImgOpacityDefault=100&borderColorDefault=cccccc&fcDefault=1c94c4&iconColorDefault=ef8c08&bgColorHover=fdf5ce&bgTextureHover=glass&bgImgOp

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\jquery-ui.min.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (29724)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):31552
                                                                                                                                                                                                                      Entropy (8bit):5.228356829465387
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:A3lcR8lOXHc11evF2+BzImH+4G6Gz5IUSc7nfZBhVY:NXHcEDBzZTG6Gz5IEBhW
                                                                                                                                                                                                                      MD5:D9A6894D9BF9260FD94A1E062A165890
                                                                                                                                                                                                                      SHA1:0845DF32B854BAA93DFC63645F1B221114BD72E6
                                                                                                                                                                                                                      SHA-256:37B2B6F30FC6719EBD365170AA229BD5DE585F2DFB4D27E076E8F9810EB1F26D
                                                                                                                                                                                                                      SHA-512:35A08E1907BC6ECEFF0712699E1678B787F8A6C3079EAB02C47FE8E1DDC616A052E3FD18AFFF3EBD9D3CABAEF9971EE9373EE5BC9E9F44F7E808D1CAC7A77F7C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CTahoma%2CVerdana%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=f6a828&bgTextureHeader=gloss_wave&bgImgOpacityHeader=35&borderColorHeader=e78f08&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=eeeeee&bgTextureContent=highlight_soft&bgImgOpacityContent=100&borderColorContent=dddddd&fcContent=333333&iconColorContent=222222&bgColorDefault=f6f6f6&bgTextureDefault=glass&bgImgOpacityDefault=100&borderColorDefault=cccccc&fcDefault=1c94c4&iconColorDefault=ef8c08&bgColorHover=fdf5ce&bgTextureHover=glass&bgImgOp

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\ui-lightness\theme.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (1405)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):18142
                                                                                                                                                                                                                      Entropy (8bit):5.0948090465904405
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:XO++jVLl/3F5fy9uCsEcI1/ePM2gmB0iBfT9RhS2wV53skuMaaSQhQz0iIhQB:XObF5fyKEUDS257
                                                                                                                                                                                                                      MD5:02E006E56B3489170E1F53DB63E7EDC9
                                                                                                                                                                                                                      SHA1:78FE0CC2E6A589A1991E91D1FC7A7F0F05EBED27
                                                                                                                                                                                                                      SHA-256:BADDAEF2A6C7B3CFF023701084D1C01E827D534829B599C4F08C10BA0C249EC6
                                                                                                                                                                                                                      SHA-512:E86DB4E092A72E76240A1BBC6B11187E817767580D6BD69B6FC0316D881CF8F7B3C7CDA940604FD7BA82A0424A906F0005EF44ED5A91CA3852DB3ADE198BF278
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Trebuchet%20MS%2CTahoma%2CVerdana%2CArial%2Csans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=4px&bgColorHeader=f6a828&bgTextureHeader=gloss_wave&bgImgOpacityHeader=35&borderColorHeader=e78f08&fcHeader=ffffff&iconColorHeader=ffffff&bgColorContent=eeeeee&bgTextureContent=highlight_soft&bgImgOpacityContent=100&borderColorContent=dddddd&fcContent=333333&iconColorContent=222222&bgColorDefault=f6f6f6&bgTextureDefault=glass&bgImgOpacityDefault=100&borderColorDefault=cccccc&fcDefault=1c94c4&iconColorDefault=ef8c08&bgColorHover=fdf5ce&bgTextureHover=glass&bgImgOpacityHover=100&borderColorHover=fbcb09&fcHover=c77405&iconColorHover=ef8c08&bgColorActive=ffffff&bgTextureActive=glass

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-bg_glass_95_fef1ec_1x400.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 400, 16-bit/color RGB, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):390
                                                                                                                                                                                                                      Entropy (8bit):6.447437739895353
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:6v/7J1r+U9+jwk1em+2vEKvEA2zS+EELEMPS:krr9+EAvEJA2zjEELEMPS
                                                                                                                                                                                                                      MD5:B64DE8410FA1D3A00CF2B1E9CCFB1258
                                                                                                                                                                                                                      SHA1:A73D3BD96E2851565DB2F68DC4023FB6FE3FF204
                                                                                                                                                                                                                      SHA-256:F1E63DDA49891B14FDEC86F5E76C606C89C249D272BFD03CEA169305752E73E5
                                                                                                                                                                                                                      SHA-512:F052A9CF6D427482BCF8F9C59F8591C8F295D09238DCC9E709F9E39AD54BCC1E4D2708FC05F6CD6E2130A290E2287ED742B6170130030C95F1981E0909A9614E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...............A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......X......tIME.....".x.......IDATH.....a........\!V....J#X.....D}.....f.>....>...P..x...x......q....u...q...f.+..6....[..\.......W.T4r...6:.]V:...,.(....8..y.G-(d...H...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-bg_gloss-wave_16_121212_500x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 500 x 100, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4031
                                                                                                                                                                                                                      Entropy (8bit):7.9028350895565165
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:fNfyjyimoWx1aaf+xWkKCce0IBbsRQ0zIKJnQc5buTWliW:l9Zt6WkceNBbsKeHZl54WL
                                                                                                                                                                                                                      MD5:39EF50F09E2809D49B8C00039CED3155
                                                                                                                                                                                                                      SHA1:8DB6F2EE92A24C760E08590C9AEA79A7CB8FB848
                                                                                                                                                                                                                      SHA-256:D98A434962B17AD62B8EB86FB75A5D2F2CEF2FE1ADAAC616FC79AC158519A5AD
                                                                                                                                                                                                                      SHA-512:4527070C6C523C9BAF4C36FB650C7F0EEF1A21A3DF5238BED51200F1152B8F02DC66C5262AF8EAAC51A8DA53EB5C63AD0506A3B28020697CD4CC2D7EBC301629
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d......<A.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x.......IDATx..]..$G.~....-...|..].H...@.t...I$H.&C....H......@\@....s..4.!..,..3.`g...UW..y...'.lOu..Y5]U....... ..'... .W.6t.X....b.`C'..... V.6t.X....b.`C'..... V.6t.X....b.`C'..... V.6t.X....b.`C'..... V.......+U..j.VE.n?k..)....+.....xW..S....Bu|4..%.G..H-G..,?.1m.h....M..*.f.!..`...H..sW.na.._...x_....^2....`?.\e....q..]..'...N..S....'^..Zw..@..=..3.u.L.)....Fr;.n.-9....(g.n.E.G.g_....I.y.d.../.......R._.A.G.S..Z.. ^58.N.+..:A...Re..i.>H.A...".k.......XB..dOy.|-7-...R..:.....ZG<-..A.m..I(..R$."....R.f|.g.........~.......G.>...._....a.8.i0.. G.4..[..7dG-..d./. 2...-Z.b.U.........O=..+..7..M.Q..kK}.A...4..m.q.?J..Me.VS......S5..]+..{W...=.e..M%<4U_W4.]/.5...4..........v..........9q..b..5A.6.....1...I.....q.8].. .k.N......N.+..f.b.... V.v..b.8m..?O..+.V.|.A...>..ZA.(....`.P........T3.Pn....].6-kg..@..f..^CGm.m.c.........;....

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-bg_highlight-hard_15_888888_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):311
                                                                                                                                                                                                                      Entropy (8bit):5.963006320820522
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPedUyKOkp4/hWwaR7znGQ8zgN+E8VLEMlVbEbp:6v/7WdU8Q3GQ8zS+EELEMPS
                                                                                                                                                                                                                      MD5:DBB10EF01FC9FF253FCDAA4D502DA438
                                                                                                                                                                                                                      SHA1:D66A5B34D620576FC79C9A8A1E6F1E16D86AF410
                                                                                                                                                                                                                      SHA-256:63CC98C1D36765DF5D7D186773D10E4EFE41DEEDE80A211D62157D7D94672963
                                                                                                                                                                                                                      SHA-512:D4B7BC8781473E26898B2E1498A1F2AC36B29353C179FA651A381AC77B75E22ED477BB3BCC7A9C9414F5170539053EA04008EB8336927368E73899B8850D9530
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......?IDAT....A.. ......>.......S.^....2HF..$.|......6l.....y.>C......=.u....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-bg_highlight-hard_55_555555_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):311
                                                                                                                                                                                                                      Entropy (8bit):5.8924441889538794
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPedUyKOkp4/hPHpKIzgN+E8VLEMlVbEbp:6v/7WdU8PHprzS+EELEMPS
                                                                                                                                                                                                                      MD5:53626545F7AAD27A50909EB0FCF5BDD8
                                                                                                                                                                                                                      SHA1:3AAE3D8D43A7B3E082CFF70E980760AC5BA6B3E2
                                                                                                                                                                                                                      SHA-256:C20A901E1AEB67A3A73BC491285DF74AA29968A42C1FC2922BF0D60B5821B1BD
                                                                                                                                                                                                                      SHA-512:9A2A72742DD65724849419A8F87F9D3AEC113A2E3B30009EE564962E8F415FC1D5C1B778D5A792D60992DF07DF11BF5DD07562965A7CF4AD4CE5F187ACF4C75E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......?IDAT..c.]...0ph!..L.60....g..os...L.o0...e....7.........N.&... ..qz......%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-bg_highlight-soft_35_adadad_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):326
                                                                                                                                                                                                                      Entropy (8bit):6.061424992259731
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPedUyKOkp4/skdptAGvHbsrpPQfzgN+E8VLEMlVbEbp:6v/7WdUAsGjs4zS+EELEMPS
                                                                                                                                                                                                                      MD5:E07630E0B48EC08F0FF665666C6B6E4D
                                                                                                                                                                                                                      SHA1:79E5622B1E1207D0C45EAAB8ABB61084DC828280
                                                                                                                                                                                                                      SHA-256:250FE740209C0879C091AF3452E8D7036D97AB24D2CA698F133FD207608B7337
                                                                                                                                                                                                                      SHA-512:034260637492FBC28756FBB1D306BD3490B3AD15A8A7D6CADF87AADD3CA0F7E9AED747EF4B4CD300B7915F9995949728ACCCDD6F199351B7B26CF2A7AF7F15A9
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......NIDAT...1..@..7.D.;..'......D.,.t.L1....B......w.xA..7.>.|...-U.k..:.....;....=....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-bg_highlight-soft_60_dddddd_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):342
                                                                                                                                                                                                                      Entropy (8bit):6.127798978260897
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPedUyKOkp4/oZ/OMpxD2zgN+E8VLEMlVbEbp:6v/7WdUpFbxD2zS+EELEMPS
                                                                                                                                                                                                                      MD5:9AD2D7E521846940F3869A9E4F73C380
                                                                                                                                                                                                                      SHA1:DF24CC6F8682C785CAF0D48F3D29731068F9EEDE
                                                                                                                                                                                                                      SHA-256:C74EFD53A0F5365611439393F36B7A8F2EA5E600BBE6188C7CF384EA407BBFFE
                                                                                                                                                                                                                      SHA-512:68E7C6681411D8F7E48D1E4AABBE7D8DF5B6FB7F98951E738FDB095577BEFFF2B687D451A91ADDF2046A283C24F1A64E70A2FF1EC87D8C4B580FEBAC1D398032
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......^IDAT..cx....@.....L..../.1.Hbx~..3........0<9..D...4.......0<x..P.p.>.}..{/..Z..I3.?D/.bA...!..@W....%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-bg_inset-soft_15_121212_1x100.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 1 x 100, 16-bit grayscale, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):322
                                                                                                                                                                                                                      Entropy (8bit):6.09678954068526
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6v/lhPedUyKOkp4/bTe9X+EsoZ7kbzgN+E8VLEMlVbEbp:6v/7WdUiTe9XFJQbzS+EELEMPS
                                                                                                                                                                                                                      MD5:956014D41F5BC21A2C79090E1DC83D59
                                                                                                                                                                                                                      SHA1:E8FB0A5D917390E211261CF172A95A8B2E06291D
                                                                                                                                                                                                                      SHA-256:E394A321626DCFF17847269BD861229BCFE6F09CDE8922CFD35608125E6ADE09
                                                                                                                                                                                                                      SHA-512:03C95D321B7DF9D8815551628A044ADC95D2AFB386481BB6ACDF4C9711673ADAF1B05C57B4A2C30C44A02252A6F2BF8AF03918A2CD46E4FDF6C3BF76D7A3F6F4
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.......d.....2.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....1.....tIME.....".x......JIDAT....1..@.D....-.m..v..b..%..*,@..<....C..N\x.......rC..w\.......l.L..P..t#...%tEXtdate:create.2016-09-14T13:34:10-04:00.. A...%tEXtdate:modify.2016-09-14T13:34:10-04:00.\......IEND.B`.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-icons_666666_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7111
                                                                                                                                                                                                                      Entropy (8bit):7.928455943008907
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:eMzXuohHXyFN1Ce1gydd84kWORcDrbeq3ek:79HXk1t1gMd8WOkrbeUek
                                                                                                                                                                                                                      MD5:D779CF92249EF61590F0B6FA32207423
                                                                                                                                                                                                                      SHA1:5D0223055783B026D13CCF508FD54317B030981E
                                                                                                                                                                                                                      SHA-256:18257A1FC35E3B8C129E2EE60DA4B617703FE80E43F8D8F3052614BF7AA8CABF
                                                                                                                                                                                                                      SHA-512:440349B6C97F034C635D731A128EA0A637867EA971631B7A0F4835EB92FD2B7F892B1AFB9CAF78681FE36EACAC8C179793159A29A2052B0F561295C359B31B36
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.f.\._....tIME.....%...'E....IDATx..{.eE}.?.H(cX.1..[R.`....J.H..E.$U....cE....Q.2;#...f.c.,Hj..cQ5...5P...qK.......$...1....%'..W.9.:..;..=...s.=..>............d.5..x..^.../.2.........mV..&.@..`..MX9......$)...=.,...0L.L...}.0~z[.....J...5..S.#.G....p_....I;,.:q! `.X% 0.\..C. ].H.....B(T..(..R....o{vX3.)...........6h.>...XhN.^.4.Ab....!CPz%..Lm0..m...m..n....m...9.c.....].=.UL.W..W7..)........6+..^;..4.~%.....px.h8..4.^.../............:...2..n..6eL.h.`~..=u.....(.#%$....4`.*.3h...5m..m.......5@.. .~5<.e..........n.oF...|..d{...U.^@...>]..L..-oz.....e..%PE..f......$\..')y8J..^k.._9&.t.;..o2.:....A.......@........px.h8..4..7..:....._+-..s.E.K%.2..5..UA...(.<..`......+P..3l..X..S..G..n%p.U".YR.[..........R...q._`....P.5`..Y.BKl.5b)....Z|.......t.Q.i.E.. Lc.J..t.S...Ch....Jgn.b..(;...Z.-..tVk.n...R71.%.5`j..i..@/...uq...4s.h.`s....... ..]&.Ua.q;].A.....

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-icons_aaaaaa_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7075
                                                                                                                                                                                                                      Entropy (8bit):7.9303849833121305
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:UXTvYXQzy0RbWcAt87YE84ate0UEXUj/SPoH7:Ux1fS87YE2e3E4/6ob
                                                                                                                                                                                                                      MD5:576B05CC7D15F49E870CF358D041772B
                                                                                                                                                                                                                      SHA1:9E461C8365CE53C0DD69BF01FD3E08C15E893CEE
                                                                                                                                                                                                                      SHA-256:36CEFEEDA29F3528EEFB7595CCA0E15E9624E7746F0F19A66EA099CC3B4833BA
                                                                                                                                                                                                                      SHA-512:492DD4EB32D24FE2ECB33C1716D850135ED17B8C928F114837587A5AE0FAD3191A51946AAF9957411B1AC17363BAC33291EEABE53B0A24A327DFBFDB9D7FD1EF
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD....i.....tIME.....%...'E....IDATx..{.$G}.?m;....!.>...l.0.][..HX.M.K....E.....)r.8...{....?ptg..Y.G.. ...b...'....8$.f..;.#...A..G......3;...=..L..........W..<................&.=.Ll&<.D.Y.V.D.^.`..O..r..`.:.$)...=.L.s....L.=?..a|..6...I#V+A...1.L).P.!......)$q..<....U`....r.2...t. )b....B.zDD....'O....{.5....[.Y.`..]az...GtwS..S..l.. 1.z..!(..h~.L.`V.U..{..g.ws...l.g......p.U.f.2..CP.....C...[.mVF.y...h8.J`....px.4.....'@....px.4... .w...d...p...)c.F{.....S.......>R$)g...3W....i...mk~[.+.O}.#c.P...._.OB..mz.-..=.)w.....i'.#...@.].S/..c.>]..L.[.......e.%PE.dR...=..\..').W..0..k.0..o2.:....A..'@....px.4.....'@....p.3........._+-..s.E.K%.2..5..UA...(.<..`......+H..=l...>0.b'G..n%p.U".YR.[..........R...q._`....H.5`...@.%6..b)....Z|.......t.Q.i.E.. Lc.J.xw.]..K... 7...........$0txzl.\.Y..wk..!uS...[..L..K..:(...f].K(......lN...u.'.vw.IdU.)n.K9(...u..f..c/.<....

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-icons_bbbbbb_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7092
                                                                                                                                                                                                                      Entropy (8bit):7.923076697213992
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:+bdL0XdnQW8FLZ3Iz6QlfUGxGO7TjLZxkSR5jsUeuOkjFWr4n2Otk54c+tEBNrDb:ykSFt+7/xpT3Zua5gewr4smcZrDaIx
                                                                                                                                                                                                                      MD5:947F1A81E0EEECAD8A78B92B269E3C2F
                                                                                                                                                                                                                      SHA1:4ADACD01B707EAF141426B565937D0651EE0F808
                                                                                                                                                                                                                      SHA-256:748E923944BED881A8384BD8F6A90D83BA56C30B3FDA34E77A3A2EB3381518F1
                                                                                                                                                                                                                      SHA-512:41C5907FA5532A13490E462CB9D5218FF06CC8B0C40DD29FCFD4BA55FAC3225D0B13A55900A3CD77B6ED36996A003D52C63A90622AEF6DB6353009892A6BE1B2
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD...>I6....tIME.....%...'E....IDATx..{.eE}.?.H(bX.1..[P.`....J.H..Ef..M.b...F....,.3...`V.;..!.]..E.<.K.@U.#"..-.gWEBL"8+qW..q.#E,9......9..w....{..u.........u.(.M.i..G....... .EH...Hx...2..$........+.\.....8..................FOoi...3.Z...W".0.<D}DV.....B.7n..Q'.....+.....q..$..q..v.C....B..T...2..m..k..5e[.7............x....T.M...M.^?3`.J...[.....Z...S0.Ms..}`.....T(/.f.}......<..)...]D..`....0.../..._.l8..4.^.../........@................=..E.M..2....`gO.{..:\.}....=....\.z...\..mc.-...>....(....W..P&}..n..b.`.....f.Q...P@..P].Xq...a.............jmP.I..U.A&..........%..`.._9u.......W.7.~!.....px.h8..4.^.../.......~g`...q...Zi...Q/zO*..9..9......C..! .....?@X.R.U.a.`}`L...Uc...%T...I.l.......8T.K.B...%...&..{FL....f..-.....g.....u..t.....H.(Z'.a.;PR.OW=%n^.<...9.t.f..e.e'..C.r..jm...C.&...[..LM.%m{...e^....%..f....lN...u..d{..$.*."n.K9(...u..f..c/.<...

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-icons_c98000_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.739641524249667
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:RNbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:5Hm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:3F3E1F1DB74D1AFEF12705208908F54E
                                                                                                                                                                                                                      SHA1:D11DE5DAF044246304F892AE14BC11929467D537
                                                                                                                                                                                                                      SHA-256:98A8B1A6BFA2BFE849A2B5218A12B0BF89DAF37C0CE965B706BAB11D01CFDD76
                                                                                                                                                                                                                      SHA-512:84587950460A23FC3A9DB512B0D4D67C6B457DF84E4DDCDB5E58285C0584A37ACB51645570E5D7E5388A6830734FDF67DA02F057A2CCEB11D044864BCF166A77
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE........................................................................................................................................................................................................F5r....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-icons_cccccc_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7034
                                                                                                                                                                                                                      Entropy (8bit):7.932139241999848
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:K6OJJxfX8+p4/rF1km/zUCVbGarOXZuphvgXad4:K1JJxPzkFWm7UJZOJgqd4
                                                                                                                                                                                                                      MD5:883030509884C748B039641F5955E85C
                                                                                                                                                                                                                      SHA1:FA1BCF0D7310168CF3DD77A30CB527A31EEB6D5C
                                                                                                                                                                                                                      SHA-256:055799E2F20C94BB0CD60D6AFB71D362DAA66AAE390032AB03C631C92FEC1860
                                                                                                                                                                                                                      SHA-512:830C390394294C460D177FB4FC0D714D05994EAC8FEB5AD98C42876F204C8FE51983C31536C84B3DD6D8DC172E24555BA06E64EFB0BAC60CB3C5C4BFB7235814
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR.............E.r@....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..8_......tIME.....%...'E...]IDATx..m..Wy.....(..R.....%..H.&.x.D..Er.....(.....D..........R....H.R;..H.]B......P.)mIX.b.R.*Ed.a^...w..;...{..s...sf...._..8k....,<...O..mB...F.. .6+.J.(.k....i.V....EG.$.......`....c........al.N..Z..._.)`Jy...<.z...B.7...N\..X.V...).)..!H..."&...!H.G.NP)~r..o.vX3.)...........{.>|DW75.9.z..i..\...2..g..w....*..cO.|o..n....m..By.....j.T&.y.JR.|.{.^.`....(5........l8<...O........h8<...O........:...2..n..6eL.h.`...y......Q.G.$....4`.*.7.^.k...R..>2...=@..lx..o..m.]..L.3_...0N;.......c..N..:...t..0..ny..'.Z....@.e.I.:...&r.....^.l..+..=.........O.5.....'@....px.4.....'@.q.30t..8._...t..../.0.....TW..c.......Q.... . )....?j......Uc...%T..g..l.......8T.K.B...%..A&~..F"....f....`.........u........H.(Z'.a.;PJ.WW]%...y..rs.Y..A>...}.....[(.vV....7pH..@..V...-...$y.....s.....@;..i.X...v.....Y.v...B....n]g.......W..c.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-icons_cd0a0a_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.739814671431308
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:ONbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:AHm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:A6A39C47239FCDBBE6E1D5BFAA7ADAC3
                                                                                                                                                                                                                      SHA1:E01C6ED29C81AD21B84D0B96427976474D77F21C
                                                                                                                                                                                                                      SHA-256:90044CC699BA3148B8F8777CF7BA69CDB63187582370AE49E3412E00056E05CB
                                                                                                                                                                                                                      SHA-512:48F691B2480F302B2064417FEEF9E28ADB28367FF2CAA549F351DD014F63A75D70AED68B546851371BEC822D7CB037CC644C6AAC1D5C2BC3B6C94E07F00CB87D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE..............................................................................................................................................................................................................................................................................................................J....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\images\ui-icons_f29a00_256x240.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PNG image data, 256 x 240, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4676
                                                                                                                                                                                                                      Entropy (8bit):7.7508488222392184
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:cg6NbtHh10+e2Np1Nvu+wIB0DRntW9A2rmL39mZnzPXfcP:cg0Hm231Nvu+wIqltWOe3nIP
                                                                                                                                                                                                                      MD5:E05F6591588CD86BE9D6A498A5EAB45A
                                                                                                                                                                                                                      SHA1:5BCC7AA52043087C1BE8D139E21E38D6F788B572
                                                                                                                                                                                                                      SHA-256:ED4D5B2DFE4CD278A8F797F68AE75A40EB186FCC932D30A85EE4A7491635191D
                                                                                                                                                                                                                      SHA-512:87783EBA19C69FFC36E7BF7199EF2EAF1FDD7AFC2B1D7BA24A9B20483CDABC81AA7458D19560C69D3EF7A14653B2454524CB99A3003CB43CAF3F85D9FC5BBF8F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR..............IJ.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...,PLTE.........................................................................................................................................................................................................b.....ctRNS.XG|"2...wf.....ZNz.@@ef.S.F..ccaM.hmz.s..}......]..........b.p...i.8*...y..X..................bKGD....H....tIME.....%...'E....IDATx..].c.....$,.'.$h....)$uZ7I_.B."H.1i....R......kgg...d.l.....>....=Y..... .d.]...s.:w/....f@e.,!..A.$...HW.......O..|..FM.Z ' ..1...d.....9. ...v.<.AAr.k.eN....f.....s...an...l......`.....vb....V..L..t.m.).u\vG(""""""..8sOp.~P.5..{BK..F....|..lAH.QJ,.`...4...&..J.'.T.o2.b....lYQI<.E`....6...-X.l..VX.H..|#j..`E..q...>B.:..q...........C7.?.....xt...v*.....8..P.6._..d.Y...J.7..%.....A,.U.4...I.Gb.(....W....p.B... .k....b*X.&

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\jquery-ui.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2363)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):36432
                                                                                                                                                                                                                      Entropy (8bit):5.2687503977040855
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:BNynb/+vaW1e076F5fyfEVDS25Vc6Kvlak:mGP7wDS2vc6Kr
                                                                                                                                                                                                                      MD5:498FA98DD64941C89E7F4B3D1C80C9A5
                                                                                                                                                                                                                      SHA1:7915CBD12C96C14602311920A64FB2D0B006C634
                                                                                                                                                                                                                      SHA-256:D15D714E3DF34F5FBAAE39857941A05315A6CF2F7BD0ED547649EC3F6D1FB80A
                                                                                                                                                                                                                      SHA-512:7A42EBBB122906601399A4861C653645D5DAD0B27E99E47D9448FFD971296716500E2A16C7D94AE0539C1419847BBBF93BAA32D20D61D9356038FAB0CA5F8745
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=888888&bgTextureHeader=highlight_hard&bgImgOpacityHeader=15&borderColorHeader=404040&fcHeader=ffffff&iconColorHeader=cccccc&bgColorContent=121212&bgTextureContent=gloss_wave&bgImgOpacityContent=16&borderColorContent=404040&fcContent=eeeeee&iconColorContent=bbbbbb&bgColorDefault=adadad&bgTextureDefault=highlight_soft&bgImgOpacityDefault=35&borderColorDefault=cccccc&fcDefault=333333&iconColorDefault=666666&bgColorHover=dddddd&bgTextureHover=highlight_soft&bgImgOpacityH

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\jquery-ui.min.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (29605)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):31158
                                                                                                                                                                                                                      Entropy (8bit):5.210561486546047
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:BNynlcR8lOXHc11evtRzWmni+4s6GxlElSc7nfZBhVBWGc:fXHcEtRzLnSs6GxlEDBhQ
                                                                                                                                                                                                                      MD5:65B8A4440ACA66315F32B3D942F89561
                                                                                                                                                                                                                      SHA1:6F9F79ADB2BB1E55AEF68C17EDA5ECC3E2FC3E4C
                                                                                                                                                                                                                      SHA-256:12B16CA33D3957B5F89BE9F5E2E8FDF444D1DDE91C3D63122BE11A0731A5DF14
                                                                                                                                                                                                                      SHA-512:68E6350CCA7F10E86648802E24522CAD7467936C12AD407B04AE71F875379DED132332A29C49228849C88442D46E0B2650353B53D60E3454A78F08D1A17EC65E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: core.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, draggable.css, resizable.css, progressbar.css, selectable.css, selectmenu.css, slider.css, sortable.css, spinner.css, tabs.css, tooltip.css, theme.css.* To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=888888&bgTextureHeader=highlight_hard&bgImgOpacityHeader=15&borderColorHeader=404040&fcHeader=ffffff&iconColorHeader=cccccc&bgColorContent=121212&bgTextureContent=gloss_wave&bgImgOpacityContent=16&borderColorContent=404040&fcContent=eeeeee&iconColorContent=bbbbbb&bgColorDefault=adadad&bgTextureDefault=highlight_soft&bgImgOpacityDefault=35&borderColorDefault=cccccc&fcDefault=333333&iconColorDefault=666666&bgColorHover=dddddd&bgTextureHover=highlight_soft&bgImgOpacityH

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui-themes-1.12.1\themes\vader\theme.css

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (1130)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):17778
                                                                                                                                                                                                                      Entropy (8bit):5.058569194973011
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:XLNyD9Mte6NF5fyjPBqcEco7xqDNYgmB0iBfT9RhS2wV53skuMaaSQhQz0iIhqcN:XLNy4F5fyfEVDS25Vc6Kvlak
                                                                                                                                                                                                                      MD5:9F76BFD262C02609A1781985C10DF2F6
                                                                                                                                                                                                                      SHA1:9237E5ADD22EF6D14D6E57C224D5DA817E198101
                                                                                                                                                                                                                      SHA-256:1413A4DBB8960D4CED5A71F06C31064A41ECBD2AB08E0B5438403207A274B47A
                                                                                                                                                                                                                      SHA-512:8F30C2BD6F9AF99E13CEF3F97D44209AD330572332451274FF10CBE36E850608F1DC4637422283F2B5BDA0F37F056D5EB54DD6F4658EFA423B47A11B322D801F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*!. * jQuery UI CSS Framework 1.12.1. * http://jqueryui.com. *. * Copyright jQuery Foundation and other contributors. * Released under the MIT license.. * http://jquery.org/license. *. * http://api.jqueryui.com/category/theming/. *. * To view and modify this theme, visit http://jqueryui.com/themeroller/?ffDefault=Helvetica%2CArial%2Csans-serif&fwDefault=normal&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=888888&bgTextureHeader=highlight_hard&bgImgOpacityHeader=15&borderColorHeader=404040&fcHeader=ffffff&iconColorHeader=cccccc&bgColorContent=121212&bgTextureContent=gloss_wave&bgImgOpacityContent=16&borderColorContent=404040&fcContent=eeeeee&iconColorContent=bbbbbb&bgColorDefault=adadad&bgTextureDefault=highlight_soft&bgImgOpacityDefault=35&borderColorDefault=cccccc&fcDefault=333333&iconColorDefault=666666&bgColorHover=dddddd&bgTextureHover=highlight_soft&bgImgOpacityHover=60&borderColorHover=dddddd&fcHover=000000&iconColorHover=c98000&bgColorActive=121212&bgTextureActive=inset_soft&b

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\jquery-ui.min.js

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (32073)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):253668
                                                                                                                                                                                                                      Entropy (8bit):5.1428695015347285
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:FkHOJD1g7SV7opRBXDrtnAcKYvFJi/5PLO1aG0qF2/nwOW16j:qp/KvjOVlFYQ16j
                                                                                                                                                                                                                      MD5:0A497D4661DF7B82FEEE14332CE0BDAF
                                                                                                                                                                                                                      SHA1:F77D06B0C5DEDEF1F1DB051A44A2B0D7F233BA3A
                                                                                                                                                                                                                      SHA-256:55ACCFF7B642C2D7A402CBE03C1494C0F14A76BC03DEE9D47D219562B6A152A5
                                                                                                                                                                                                                      SHA-512:E036A2057F2BB203A805234B71E43F222C4317EB940D5D2126B417FCC27D470259083A9B129D048C8428746C6CCCFB53A7095E9C9CE74768E48035AA8F81ECF8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:/*! jQuery UI - v1.12.1 - 2016-09-14.* http://jqueryui.com.* Includes: widget.js, position.js, data.js, disable-selection.js, effect.js, effects/effect-blind.js, effects/effect-bounce.js, effects/effect-clip.js, effects/effect-drop.js, effects/effect-explode.js, effects/effect-fade.js, effects/effect-fold.js, effects/effect-highlight.js, effects/effect-puff.js, effects/effect-pulsate.js, effects/effect-scale.js, effects/effect-shake.js, effects/effect-size.js, effects/effect-slide.js, effects/effect-transfer.js, focusable.js, form-reset-mixin.js, jquery-1-7.js, keycode.js, labels.js, scroll-parent.js, tabbable.js, unique-id.js, widgets/accordion.js, widgets/autocomplete.js, widgets/button.js, widgets/checkboxradio.js, widgets/controlgroup.js, widgets/datepicker.js, widgets/dialog.js, widgets/draggable.js, widgets/droppable.js, widgets/menu.js, widgets/mouse.js, widgets/progressbar.js, widgets/resizable.js, widgets/selectable.js, widgets/selectmenu.js, widgets/slider.js, widgets/sortabl

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\payserver\www\vendor\qrcode.js

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):56694
                                                                                                                                                                                                                      Entropy (8bit):4.735778390117143
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:pRAGaUobYVVPh7Inoh7SlSKrnef8mLtEYbNyfPVrhZv9wy0aQiCIHjCg9/GAgwho:BaUo2Yoh7SlSKrnefJSY5yeac
                                                                                                                                                                                                                      MD5:6E6189E2B177B3D014321EDAD68FD73C
                                                                                                                                                                                                                      SHA1:4C79BE1679603EF9691B98A90617AA1E534E93EF
                                                                                                                                                                                                                      SHA-256:18AE399F81182BC9DE916E9C77B195DF20CC58D6F2D55A62B085A299F1BF1780
                                                                                                                                                                                                                      SHA-512:E96386EFA01773CAE582D1982C684383B948CD91B609CF95AD26A6BE0A5E0588316AE1AEA0CB9AEAE2A59783AC67426F552B75DA5457FFDB82997CE4B77FF07E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview://---------------------------------------------------------------------.//.// QR Code Generator for JavaScript.//.// Copyright (c) 2009 Kazuhiko Arase.//.// URL: http://www.d-project.com/.//.// Licensed under the MIT license:.// http://www.opensource.org/licenses/mit-license.php.//.// The word 'QR Code' is registered trademark of.// DENSO WAVE INCORPORATED.// http://www.denso-wave.com/qrcode/faqpatent-e.html.//.//---------------------------------------------------------------------..var qrcode = function() {.. //---------------------------------------------------------------------. // qrcode. //---------------------------------------------------------------------.. /**. * qrcode. * @param typeNumber 1 to 40. * @param errorCorrectionLevel 'L','M','Q','H'. */. var qrcode = function(typeNumber, errorCorrectionLevel) {.. var PAD0 = 0xEC;. var PAD1 = 0x11;.. var _typeNumber = typeNumber;. var _errorCorrectionLevel = QRErrorCorrectionLevel[errorCorrectionLevel];.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\revealer\DejaVuSansMono-Bold.ttf

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:TrueType Font data, 18 tables, 1st "FFTM", 22 names, Macintosh
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):331536
                                                                                                                                                                                                                      Entropy (8bit):6.789741149323993
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6144:l2Y6/fJe6mrBD75NsETSDXE1u7I4fEZZ20eB/JGZHm3:l2YQ1mrh78XEU7nfEZZ27B6m3
                                                                                                                                                                                                                      MD5:FB4EC87D51DDBE7C5D2F9E8F09D7E39F
                                                                                                                                                                                                                      SHA1:FF23758A6E42BACB4C02813603E5E12AD5AEF30C
                                                                                                                                                                                                                      SHA-256:BAADA9A5172FE20886251AFF0433FC38461912D5DAF07287E7BEE56620A8DA96
                                                                                                                                                                                                                      SHA-512:272B8B31B21904DF61198311F6B803CF796BA26B65DE5EFA2530924F270E2FDC0AB888DA78BAE71C38DB805C5E43BE91FF81050594EB6A889E35F1C33E3C2F04
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:........... FFTMo9.....,....GDEFd.W....H...tGPOS:U-........\GSUB.\..........OS/2.&...." ...Vcmapdi...."x...6cvt .I.*..8.....fpgmq49j..:4....gasp......:.....glyf...F..:....head.u.........6hhea...........$hmtx............loca..t..9...3.maxp......m.... namet4.j..m...!Bpost.K........{0prepLQ.3.................=.......}.......}...........l...................................u...v..............................................................................DFLT.&arab.0cyrl.>grek.Plao .\latn.h............................SRB ...................................4..ISM .4KSM .4LSM .4MOL .4NSM .4ROM .4SKS .4SSM .4..........mark..mark.&mark..mkmk.4.........................................$.,.4.<.D.L.T.......H.......n.................................................................".........j.............{.........j.....&.....0...........j.:...j.......|.......y.z.}.................j.Q...].j...j.h.................$.6.H.Z.l.~.............P...<...........x...................P...<...........<..........

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\revealer\LICENSE_DEJAVU.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4816
                                                                                                                                                                                                                      Entropy (8bit):5.077864397875037
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:mGMeXeAJiP/hS6c4UQHDoCr49rK9eA5KPQOZQe1DcsGQHSBZoGrDebc:m6Xic6c4UQHDFr409OG+csGQHSflrj
                                                                                                                                                                                                                      MD5:9F867DA7A73FAD2715291348E80D0763
                                                                                                                                                                                                                      SHA1:23E8FED3E3499427EF5A80CBFF0ACA0946140493
                                                                                                                                                                                                                      SHA-256:D75938DEC098F06F0AC3C00853065D94F020BE1C3C62EF1DC2975BA15B4D9B0E
                                                                                                                                                                                                                      SHA-512:7510D6187016069096A33D88DB3B1144B6418362604CBEB8EE32ECA4B2BB854E9043F666078521FC9772985864AABFFFFF62680A8A49ECE89AFA33436F4DB405
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:Fonts are (c) Bitstream (see below). DejaVu changes are in public domain..Glyphs imported from Arev fonts are (c) Tavmjong Bah (see below)..Bitstream Vera Fonts Copyright.------------------------------..Copyright (c) 2003 by Bitstream, Inc. All Rights Reserved. Bitstream Vera is.a trademark of Bitstream, Inc...Permission is hereby granted, free of charge, to any person obtaining a copy.of the fonts accompanying this license ("Fonts") and associated.documentation files (the "Font Software"), to reproduce and distribute the.Font Software, including without limitation the rights to use, copy, merge,.publish, distribute, and/or sell copies of the Font Software, and to permit.persons to whom the Font Software is furnished to do so, subject to the.following conditions:..The above copyright and trademark notices and this permission notice shall.be included in all copies of one or more of the Font Software typefaces...The Font Software may be modified, altered, or added to, and in particular.t

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\revealer\SIL Open Font License.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (591)
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4525
                                                                                                                                                                                                                      Entropy (8bit):4.9314245287864855
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:3hn52iBCxwDXFeyKnjNXiSJ2lAjaFz+PPvcyqqlQHRoh:32uC2m0SJ2lA9PPfQHRq
                                                                                                                                                                                                                      MD5:6A445E3B469CBC2637D00771A19D63FA
                                                                                                                                                                                                                      SHA1:015CD2F6BB6E7049412B176B2BE4C41A63A2ACE6
                                                                                                                                                                                                                      SHA-256:D73F22C5F15342B572FEE0EF98FF7FDFA8CD3832CB37EFF44B0C6FFE3BCD96E2
                                                                                                                                                                                                                      SHA-512:8880B24D74D4ABB14149B81597B39DA0606216AF55C9989D376050026405859807534EBEF7506A6A0AD0F6829E6741934A7C70E1FE9569E88A7F818C6C74252D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:Copyright 2010, 2012 Adobe Systems Incorporated (http://www.adobe.com/), with Reserved Font Name 'Source'. All Rights Reserved. Source is a trademark of Adobe Systems Incorporated in the United States and/or other countries...This Font Software is licensed under the SIL Open Font License, Version 1.1..This license is copied below, and is also available with a FAQ at: http://scripts.sil.org/OFL..-----------------------------------------------------------.SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007.-----------------------------------------------------------..PREAMBLE.The goals of the Open Font License (OFL) are to stimulate worldwide development of collaborative font projects, to support the font creation efforts of academic and linguistic communities, and to provide a free and open framework in which fonts may be shared and improved in partnership with others...The OFL allows the licensed fonts to be used, studied, modified and redistributed freely as long as they are not sold

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\revealer\SourceSansPro-Bold.otf

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:OpenType font data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):235128
                                                                                                                                                                                                                      Entropy (8bit):6.369530846550487
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6144:Ao7OQyeiLLF2uajmLJnZXP8eayy+HSSTVv/Ihp:ACOaiLLeofyeYp
                                                                                                                                                                                                                      MD5:1A2A157BFD94B250884C09F1BD57A0BB
                                                                                                                                                                                                                      SHA1:F4D98C36159F7CF22BA1966B94598D4E88C57C33
                                                                                                                                                                                                                      SHA-256:9B8BD174F97413334E317BE808D14D0FF8F6EFED79A69299D84384C7E10E9312
                                                                                                                                                                                                                      SHA-512:2381D87FE9D3C1034C73E64573E55E2B1306B48CF26439F574560E4F3FDB1B2EBC28A04A160376DFED965D8A6068DDC40357BFDE861A1A987352F3443D14BD72
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:OTTO.......`BASEe.]...}....FCFF .)s4..Dl....DSIG...)..}`....GDEF..z..<.....GPOS.{....|....TGSUB...+..@h..<ZOS/2_.....P...`cmap.<.5......6^head..zu.......6hhea...U...$...$hmtx.c.....L...Xmaxp..P....H....name..h........<post...2..DL... ..........._.<......................7...m...........................7.7.m....................P........,.........X...K...X...^.2.)............`...............ADBO. . ............ .............. .....$...........p.............p.....................#.......................8.......................`.............d...........~...................................3...........M...........Y...........c...........n...........y.......................b.....................F...........(...........p...........$.f.....................4.J...........~.........2........... ...........4.........................4...........H...........^...........tCopyright 2010, 2012, 2014 Adobe Systems Incorporated (http://www.adobe.com/), with Reserved Font Name .Source..Source Sans ProBol

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\revealer\__init__.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):338
                                                                                                                                                                                                                      Entropy (8bit):4.976373651046497
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:1YvQ7rhizUooAecRHleZekrytS4yFRlEU8oVmTq+askR1TFaHXZQGVrIr:1YvQJiz1RWkSrG3O9dR1TUHJQGV0r
                                                                                                                                                                                                                      MD5:A46F07365C49838A07A263378E6FB8B1
                                                                                                                                                                                                                      SHA1:3C5AE47FA123862EAF86B5A5A9F36FAEB1643D94
                                                                                                                                                                                                                      SHA-256:1989DF20ADAB8D133B103E417CC4203029074C4E8F43FBB3530A10691907BCAD
                                                                                                                                                                                                                      SHA-512:D2C381AE593A09B60C4C4EA123364394E6D88374771B03ED5FA580B069AC113A40D34AAA65F6D74118AC513DE2DD3A7BF636F8AFDC964648524FB3C74AAF52D0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from electrum.i18n import _..fullname = _('Revealer Backup Utility').description = ''.join(["<br/>",. "<b>"+_("Do you have something to hide ?")+"</b>", '<br/>', '<br/>',. _("This plug-in allows you to create a visually encrypted backup of your wallet seeds, or of custom alphanumeric secrets."), '<br/>']).available_for = ['qt']...

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\revealer\hmac_drbg.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1826
                                                                                                                                                                                                                      Entropy (8bit):5.120325552455995
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:raJHlxE35QHOs5exm3ogF5Ie6mdTCG+zVwJu:eupQHTo86ZGu
                                                                                                                                                                                                                      MD5:D5013CD088CA262AED345AD253C661CC
                                                                                                                                                                                                                      SHA1:B6A887E25EC2E7AD91D095B0FA71E360FEDDC676
                                                                                                                                                                                                                      SHA-256:EBADC22762FCC44BD99903D91380C7E39B7791EF0FC848819D9B649BFC43FD0F
                                                                                                                                                                                                                      SHA-512:8CD0D87F2A3D79688E2037D78218C25B6A7D9D8B12AA6BF853199C28A52B65200E4CDE6F0730F96DA2497D2E183CF88A630E5EB22D0059165E48F4B9ACDBF9E9
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:'''.Copyright (c) 2014 David Lazar <lazard@mit.edu>..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\revealer\qt.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):38723
                                                                                                                                                                                                                      Entropy (8bit):4.634075170233596
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:x957z2ZJuFgOOklFHQWX00yZ9oa9QW/JCVahuknRRn4NYnokuMhNZ7bZMeHq8EzR:xjRnwzLoa9QW/JCGl5bt5C3
                                                                                                                                                                                                                      MD5:BAA00C5E201E3FB0A5047F747180DFF2
                                                                                                                                                                                                                      SHA1:44C1D41540EF622CF8728900D1227FB57DA75A03
                                                                                                                                                                                                                      SHA-256:304B643DED6DBE4B5701D64806F3E3F910F068C5F87FDBBE07C754184F5CC0C1
                                                                                                                                                                                                                      SHA-512:FE8386B650E35DEEC6104B098BD5C591238D6D2D41B96169683CA1EFB03F3BB280F46439C985C6F630ACFF937BC6E9AC7858111B338F3A8B7F8085D5009AFDE0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:'''..Revealer.Do you have something to hide?.Secret backup plug-in for the electrum wallet...Copyright:. 2017 Tiago Romagnani Silveira. 2023 Soren Stoutner <soren@stoutner.com>..Distributed under the MIT software license, see the accompanying.file LICENCE or http://www.opensource.org/licenses/mit-license.php..'''..import os.import random.import traceback.from decimal import Decimal.from functools import partial.import sys..import qrcode.from PyQt5.QtPrintSupport import QPrinter.from PyQt5.QtCore import Qt, QRectF, QRect, QSizeF, QUrl, QPoint, QSize.from PyQt5.QtGui import (QPixmap, QImage, QBitmap, QPainter, QFontDatabase, QPen, QFont,. QColor, QDesktopServices, qRgba, QPainterPath).from PyQt5.QtWidgets import (QGridLayout, QVBoxLayout, QHBoxLayout, QLabel,. QPushButton, QLineEdit)..from electrum.plugin import hook.from electrum.i18n import _.from electrum.util import make_dir, InvalidPassword, UserCancelled.from electrum.gui.qt

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\revealer\revealer.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3559
                                                                                                                                                                                                                      Entropy (8bit):4.545874647248047
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:a7iFbsTt5NqX0lNx0IYqWGxc10M6ZeeneBbriKmoY/f8SeDh:Iiy5400zkeenQuveN
                                                                                                                                                                                                                      MD5:2B64D9140F5EFAE125B249C28EC2BBBA
                                                                                                                                                                                                                      SHA1:AB7A1EB80DC0586AA79F5EAB4B77B9ACD8A0D275
                                                                                                                                                                                                                      SHA-256:49D230C7A399DBC2067E567E9C7B7D9AF50DE99CF3211A6350700AF4E17ED007
                                                                                                                                                                                                                      SHA-512:A16ED1DE561ACCF8574870022851AADB99C0CD8C442D6323814AE2C27466D00BB38C5D1FB33595C071D68E91EA282DE30EE61352D7868A546C89EC731A21529E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:import random.import os.from hashlib import sha256.from typing import NamedTuple, Optional, Dict, Tuple..from electrum.plugin import BasePlugin.from electrum.util import to_bytes, bfh..from .hmac_drbg import DRBG...class VersionedSeed(NamedTuple):. version: str. seed: str. checksum: str.. def get_ui_string_version_plus_seed(self):. version, seed = self.version, self.seed. assert isinstance(version, str) and len(version) == 1, version. assert isinstance(seed, str) and len(seed) >= 32. ret = version + seed. ret = ret.upper(). return ' '.join(ret[i : i+4] for i in range(0, len(ret), 4))...class RevealerPlugin(BasePlugin):.. LATEST_VERSION = '1'. KNOWN_VERSIONS = ('0', '1'). assert LATEST_VERSION in KNOWN_VERSIONS.. SIZE = (159, 97).. def __init__(self, parent, config, name):. BasePlugin.__init__(self, parent, config, name).. @classmethod. def code_hashid(cls, txt: str) -> str:. txt = txt.lower().

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\safe_t\__init__.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):299
                                                                                                                                                                                                                      Entropy (8bit):4.87862334366989
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:1YvQ7rhsrMv6IFQVR1OMCHZ8iWUl0MACwKNQo6KC7V44WGVrIeCM7iv:1YvQJAS6DnOx58W0t2C5uGV0dM+v
                                                                                                                                                                                                                      MD5:343121E1057A6FC48EC3C10A58D773EC
                                                                                                                                                                                                                      SHA1:13B5D7FD4B839D74221A251647EB2AE9EAD318E7
                                                                                                                                                                                                                      SHA-256:DD7FFFF8D2DD5E073CA708875E3DB16625AD5ECA0C9D3E1702A714384C6BF096
                                                                                                                                                                                                                      SHA-512:7F220F35EFB066FA5DBE94180785F14F53B024774030E86A186249D3CB39CB98BEFB90C218A144F2771B5F4F0C6ADCF3CB4DC52D2FFD023C356CB0EA0E3C465C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from electrum.i18n import _..fullname = 'Safe-T mini Wallet'.description = _('Provides support for Safe-T mini hardware wallet').requires = [('safetlib','github.com/archos-safe-t/python-safet')].registers_keystore = ('hardware', 'safe_t', _("Safe-T mini wallet")).available_for = ['qt', 'cmdline']..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\safe_t\client.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):437
                                                                                                                                                                                                                      Entropy (8bit):4.559059320330288
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:1xRPRXZI6FDd0zjDdoI90x1AF9AVnIyAVlDA6Jq1Vy:1x3/CzvuAF9ArAPA6Jqi
                                                                                                                                                                                                                      MD5:5944759562DC7E18859E3C5B7A21BB40
                                                                                                                                                                                                                      SHA1:A54A0F9614D768D02F4E671653988286725CE330
                                                                                                                                                                                                                      SHA-256:BA33F2F015236FBBCD6D41F9B8E4E3CAB69464F119C53D7EB0D9B812AB3B189B
                                                                                                                                                                                                                      SHA-512:CFA7ECF995DDEB7B0DAC502DF224938463DD3AD53D47212366EFABAF110E06419069839168F5E95EFB5388F5040A49B71C147AD9496C4C20902E946BBC19902A
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from safetlib.client import proto, BaseClient, ProtocolMixin.from .clientbase import SafeTClientBase..class SafeTClient(SafeTClientBase, ProtocolMixin, BaseClient):. def __init__(self, transport, handler, plugin):. BaseClient.__init__(self, transport=transport). ProtocolMixin.__init__(self, transport=transport). SafeTClientBase.__init__(self, handler, plugin, proto)...SafeTClientBase.wrap_methods(SafeTClient).

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\safe_t\clientbase.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):10178
                                                                                                                                                                                                                      Entropy (8bit):4.5253358235227354
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:C488tMUvff5J11Rku28Alve/h2B0oyCGOAiwvt:28tjve/+2WoyD5b
                                                                                                                                                                                                                      MD5:8D278A0B2B3B0C665BD311F17878A3F3
                                                                                                                                                                                                                      SHA1:D6BA80C0E077B09BD00713578A3FABCA777C035E
                                                                                                                                                                                                                      SHA-256:F79102D2776453454990CC4A28BD1A8ED69B54B0AD783F0024464AC21E659A30
                                                                                                                                                                                                                      SHA-512:05D59F95D4A91DAE2922F8A460F68E7686F95C6156B8F55F407B083D141C7CAE847FBF7FF0BEA2EF3E74A0EB7FE3A3DD2575C2286BA61485DD6E752893AC75A6
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:import time.from struct import pack.from typing import Optional..from electrum import ecc.from electrum.i18n import _.from electrum.util import UserCancelled.from electrum.keystore import bip39_normalize_passphrase.from electrum.bip32 import BIP32Node, convert_bip32_strpath_to_intpath.from electrum.logging import Logger.from electrum.plugin import runs_in_hwd_thread.from electrum.plugins.hw_wallet.plugin import HardwareClientBase, HardwareHandlerBase...class GuiMixin(object):. # Requires: self.proto, self.device. handler: Optional[HardwareHandlerBase].. # ref: https://github.com/trezor/trezor-common/blob/44dfb07cfaafffada4b2ce0d15ba1d90d17cf35e/protob/types.proto#L89. messages = {. 3: _("Confirm the transaction output on your {} device"),. 4: _("Confirm internal entropy on your {} device to begin"),. 5: _("Write down the seed word shown on your {}"),. 6: _("Confirm on your {} that you want to wipe it clean"),. 7: _("Confirm on your {} devi

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\safe_t\cmdline.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):396
                                                                                                                                                                                                                      Entropy (8bit):4.478728505749281
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:1KM82qFD5+85jEI2Hvsb/aCTATSvehahBNA099a/:1/KcoE3Hvsb/aC9sahfA0y/
                                                                                                                                                                                                                      MD5:86DAE1F1ED0C3C4188E9A432E0E86B5F
                                                                                                                                                                                                                      SHA1:B6157EA178F5F84201EF1F299DA9473CB21E4C0F
                                                                                                                                                                                                                      SHA-256:9CFBA2C4F909B87CBD9493F72FFFF4A2D8B3870759B77D84B02DAB2ABF761F57
                                                                                                                                                                                                                      SHA-512:55DBF9C52BFD4A2EDC40705FEB5F8CBEBDB92449396C772EF24AD5BDAC90C2F4CFA77CDC0CAE71DBCAA12EC7DE56C8E9ABFBFCF458F1295947775512AC99A8D9
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from electrum.plugin import hook.from .safe_t import SafeTPlugin.from ..hw_wallet import CmdLineHandler..class Plugin(SafeTPlugin):. handler = CmdLineHandler(). @hook. def init_keystore(self, keystore):. if not isinstance(keystore, self.keystore_class):. return. keystore.handler = self.handler.. def create_handler(self, window):. return self.handler.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\safe_t\qt.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):26464
                                                                                                                                                                                                                      Entropy (8bit):4.609627644960407
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:euq1cnVcNjxHyTWYO0ZF2lvVSjlmmvi4yL6OaoJa4z1MukFviY17rBF:riyTrV2lvVSjlmmvi4yL6OaoJa4z1+Rz
                                                                                                                                                                                                                      MD5:7830105DEF4B9F5F05533A620B834FD5
                                                                                                                                                                                                                      SHA1:32D2BC511319806D569EEC399E1ACA1372715525
                                                                                                                                                                                                                      SHA-256:249B34862EA38C1E24D5A0B39F29F8211FF49D8448B32BF71C389871B8DD16D7
                                                                                                                                                                                                                      SHA-512:40C2F090A085C201807AF1A6360FE476B8BF4CAC00270BB948A2FC9201309989810196DF4E56C7AC320FD9E06AADC3FBE7C9DA335094419CBE61764755B5FD1F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:import threading.from functools import partial.from typing import TYPE_CHECKING..from PyQt5.QtCore import Qt, pyqtSignal, QRegExp.from PyQt5.QtGui import QRegExpValidator.from PyQt5.QtWidgets import (QVBoxLayout, QLabel, QGridLayout, QPushButton,. QHBoxLayout, QButtonGroup, QGroupBox,. QTextEdit, QLineEdit, QRadioButton, QCheckBox, QWidget,. QMessageBox, QFileDialog, QSlider, QTabWidget)..from electrum.gui.qt.util import (WindowModalDialog, WWLabel, Buttons, CancelButton,. OkButton, CloseButton, getOpenFileName, ChoiceWidget).from electrum.i18n import _.from electrum.plugin import hook.from electrum.logging import Logger..from ..hw_wallet.qt import QtHandlerBase, QtPluginBase.from ..hw_wallet.plugin import only_hook_if_libraries_available.from .safe_t import SafeTPlugin, TIM_NEW, TIM_RECOVER, TIM_MNEMONIC, TIM_PRIVKEY..from electrum.gui.qt.wizard.wallet import WCScriptAn

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\safe_t\safe_t.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):17484
                                                                                                                                                                                                                      Entropy (8bit):4.4774263925224265
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:4vInEP87zX3kMaWn0Erq7ZaQUdmADh3h4qb1vlzoVODrwTcaCkjmc3Y5FCKBJ:OuEE7zXab5A11X4TRpS465
                                                                                                                                                                                                                      MD5:9777E76D4BB43B3CBFEA37E17AA027D3
                                                                                                                                                                                                                      SHA1:AFB13514441386BA154C625E5C3DB106F54FFC3B
                                                                                                                                                                                                                      SHA-256:0D1926DBF570BBEDA5FB036EFA1E0C7415AA292AA196E2511AA85563CCF39A72
                                                                                                                                                                                                                      SHA-512:D891333E8401EBD861C63398763936E90A59057DB8E27373766B4952F116518B058EB087EA8E11BE5B57E3E5AD6524E1C6D3421EA33B81BA2FAA759CDA798C44
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from typing import Optional, TYPE_CHECKING, Sequence..from electrum.util import UserFacingException.from electrum.bip32 import BIP32Node.from electrum import descriptor.from electrum import constants.from electrum.i18n import _.from electrum.plugin import Device, runs_in_hwd_thread.from electrum.transaction import Transaction, PartialTransaction, PartialTxInput, Sighash.from electrum.keystore import Hardware_KeyStore..from ..hw_wallet import HW_PluginBase.from ..hw_wallet.plugin import is_any_tx_output_on_change_branch, trezor_validate_op_return_output_and_get_data..if TYPE_CHECKING:. from .client import SafeTClient. from electrum.plugin import DeviceInfo. from electrum.wizard import NewWalletWizard..# Safe-T mini initialization methods.TIM_NEW, TIM_RECOVER, TIM_MNEMONIC, TIM_PRIVKEY = range(0, 4)...class SafeTKeyStore(Hardware_KeyStore):. hw_type = 'safe_t'. device = 'Safe-T mini'.. plugin: 'SafeTPlugin'.. def decrypt_message(self, sequence, message, password):.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\safe_t\transport.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3566
                                                                                                                                                                                                                      Entropy (8bit):4.057092640627583
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:AQ2A08bYgHtJsEQFqHmEKdj1mcCFseqH0K01MCJz2w2H6z0r:9/ZbHYpqHjKR1TCFseqH0K01MCkJ20r
                                                                                                                                                                                                                      MD5:8D74F45856984B897234324DDDDA24B1
                                                                                                                                                                                                                      SHA1:99E08A642EEB29C436915AE0D2D1CA3B54FC45E8
                                                                                                                                                                                                                      SHA-256:11805CAB34CFA8D9E5649660F8EDA874DA3B838D9A798FFF73AF36A99B6C5942
                                                                                                                                                                                                                      SHA-512:5896102EE4CF79061E9F5FEEA99AF9CABB572ED43CC99D961D1FA16B085E551AF2CD61062C316605A9777032CB7961B42C61BC35B8F515BC880594DB86939441
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from electrum.logging import get_logger..._logger = get_logger(__name__)...class SafeTTransport:.. @staticmethod. def all_transports():. """Reimplemented safetlib.transport.all_transports so that we can. enable/disable specific transports.. """. # NOTE: the bridge and UDP transports are disabled as they are using. # the same ports as trezor. try:. # only to detect safetlib version. from safetlib.transport import all_transports. except ImportError:. # old safetlib. compat for safetlib < 0.9.2. transports = []. #try:. # from safetlib.transport_bridge import BridgeTransport. # transports.append(BridgeTransport). #except BaseException:. # pass. try:. from safetlib.transport_hid import HidTransport. transports.append(HidTransport). except BaseException:. pass.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\swapserver\__init__.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):281
                                                                                                                                                                                                                      Entropy (8bit):4.673123753641383
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:1YvQ7rh7ZFI3asnkDeh1Ebt+W/ir0aOvUTiVrmin:1YvQJ10aTDei+GxafOVDn
                                                                                                                                                                                                                      MD5:8B3821DB8DBE1616231CD84E32E673C0
                                                                                                                                                                                                                      SHA1:9813ED26316C86D4CBE5BC63E59B86CF43DDA484
                                                                                                                                                                                                                      SHA-256:8D618898B3BD6026EA29F834AFE110C51CABF0AA33ADE67B100BC1C10035FF10
                                                                                                                                                                                                                      SHA-512:678E5EB82260EAFE9F999A64C10FC52F1D7278B7D971652CCD0A88A48E41BBF5EEEB32AD3B3F14CE556027550F3C1E3890C6A43263BA18B12AEBBBD09B923CB2
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from electrum.i18n import _..fullname = _('SwapServer').description = """.Submarine swap server for an Electrum daemon...Example setup:.. electrum -o setconfig use_swapserver True. electrum -o setconfig swapserver_port 5455. electrum daemon -v.."""..available_for = ['cmdline'].

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\swapserver\cmdline.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1256
                                                                                                                                                                                                                      Entropy (8bit):5.155823600669133
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:Uo29k4JHWWV0yPP3VtkHe1oai9QHlsUjH8Ok46+d5Eo3DqeFhiV:Ul9tJdVlPvLTmawQHlsyHIO5d3D1Fq
                                                                                                                                                                                                                      MD5:6EC9B7A969DA6EB7CEA614180200F666
                                                                                                                                                                                                                      SHA1:41EC25724D7BD518FB93773A334D819A0758B8C3
                                                                                                                                                                                                                      SHA-256:38316F0A117F3FD4E6BC00F1FE17A409A2CC3CBABDD729EBDA07A979E907FBED
                                                                                                                                                                                                                      SHA-512:657D6A40C968228B3A73D318E6DF99AF41F2E7E42A8E0B93103EC54097A543549EBDC14699FF62A51273678301AEBEB4644947063B4973415E26720DFEB06B13
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:#!/usr/bin/env python.#.# Electrum - Lightweight Bitcoin Client.# Copyright (C) 2023 The Electrum Developers.#.# Permission is hereby granted, free of charge, to any person.# obtaining a copy of this software and associated documentation files.# (the "Software"), to deal in the Software without restriction,.# including without limitation the rights to use, copy, modify, merge,.# publish, distribute, sublicense, and/or sell copies of the Software,.# and to permit persons to whom the Software is furnished to do so,.# subject to the following conditions:.#.# The above copyright notice and this permission notice shall be.# included in all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LI

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\swapserver\server.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5604
                                                                                                                                                                                                                      Entropy (8bit):4.247659402001842
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:gtk7UOhk7dkqudkq+gdkqaKhQ3R81jn7Wn7CyiSCyFOFRL7sKjobNIONKtAAb:OOK7m3m6mghXfsCyiSCyFAZ1b
                                                                                                                                                                                                                      MD5:F712135399E696A75ACDEE2DFC669878
                                                                                                                                                                                                                      SHA1:94A94A5AFEBF491F29736439136941AFBAE49E5C
                                                                                                                                                                                                                      SHA-256:FB9E1A4DAD21967653FFFC3AB1D79691ACCC5BED52F11CF2F2973373C29EDF4F
                                                                                                                                                                                                                      SHA-512:551089C8229B5C898E9417291AC314B8F1066431B0B0BB5980B0B487D7569DB83635376B9E88C6A5B02382BA53DBD363077C162A4C763032C340BAE63219A648
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:import os.import asyncio.from collections import defaultdict.from typing import TYPE_CHECKING..from aiohttp import web..from electrum.util import log_exceptions, ignore_exceptions.from electrum.logging import Logger.from electrum.util import EventListener.from electrum.lnaddr import lndecode..if TYPE_CHECKING:. from electrum.simple_config import SimpleConfig. from electrum.wallet import Abstract_Wallet...class SwapServer(Logger, EventListener):. """. public API:. - getpairs. - createswap. """.. WWW_DIR = os.path.join(os.path.dirname(__file__), 'www').. def __init__(self, config: 'SimpleConfig', wallet: 'Abstract_Wallet'):. Logger.__init__(self). self.config = config. self.wallet = wallet. self.sm = self.wallet.lnworker.swap_manager. self.port = self.config.SWAPSERVER_PORT. self.register_callbacks() # eventlistener.. self.pending = defaultdict(asyncio.Event). self.pending_msg = {}.. @ignore_exceptions.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\swapserver\swapserver.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2173
                                                                                                                                                                                                                      Entropy (8bit):5.070264365552861
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:Ul9tJdVlPvLTmawQHlsyHIO5d3D1Fj++G4O83VyK:SzPjdwQHzJDS+G4l
                                                                                                                                                                                                                      MD5:66DDC612C6AC03F03BF12047B2C01AEE
                                                                                                                                                                                                                      SHA1:56F557E5F66F0ED5E3B697DABF3D5F550FA9E807
                                                                                                                                                                                                                      SHA-256:7F9C7EC1D215BB53BF2654550FF7445F22854B6AAF95562C23112B2B92469BD9
                                                                                                                                                                                                                      SHA-512:69D50ADCEC08B1B9A26793E910E174B08BA30C4304705F1B1BF88409E3E26670F4CD6D9EA1F76FC13BEE3D59F6A7E6348E22C65C6A91D6BC258BC5683F07B612
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:#!/usr/bin/env python.#.# Electrum - Lightweight Bitcoin Client.# Copyright (C) 2023 The Electrum Developers.#.# Permission is hereby granted, free of charge, to any person.# obtaining a copy of this software and associated documentation files.# (the "Software"), to deal in the Software without restriction,.# including without limitation the rights to use, copy, modify, merge,.# publish, distribute, sublicense, and/or sell copies of the Software,.# and to permit persons to whom the Software is furnished to do so,.# subject to the following conditions:.#.# The above copyright notice and this permission notice shall be.# included in all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LI

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\trezor\__init__.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):272
                                                                                                                                                                                                                      Entropy (8bit):4.786008146303495
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:1YvQ7rhyQfgv6IF3KaOIBZf+LMpQwKNQo6Kw6g+WGVrIeCM7iv:1YvQJyKe66OIBZ1ph2wfGV0dM+v
                                                                                                                                                                                                                      MD5:E058B599B9BB73EDF3E28A02C437BE26
                                                                                                                                                                                                                      SHA1:831B4631971268A66B515A093B67D2D1AB84A01D
                                                                                                                                                                                                                      SHA-256:FD72B5833DC8DBCB9B96B5432AE494FBDB296604CBAF72D0F4B86B926C61259D
                                                                                                                                                                                                                      SHA-512:C6E2752963378AEB885F252DE9D1744769484EFCE08666B931ACEF5ECBEFA12A67BB2BCBFD0A58FC2725AF186E99C0A9A25E7C79A2045AF12E376263A5D82F00
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from electrum.i18n import _..fullname = 'Trezor Wallet'.description = _('Provides support for Trezor hardware wallet').requires = [('trezorlib','pypi.org/project/trezor/')].registers_keystore = ('hardware', 'trezor', _("Trezor wallet")).available_for = ['qt', 'cmdline']..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\trezor\clientbase.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):12888
                                                                                                                                                                                                                      Entropy (8bit):4.509681343167102
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:sEKDuv6c1tyNQ8doIh8lI0KpNpeCaO9Z51mNl05BZWhz:xv6c1tyNBdo7dKrpepuZ51wAWhz
                                                                                                                                                                                                                      MD5:DAA68E004400994AAA6965D32DBA53FE
                                                                                                                                                                                                                      SHA1:78D133C1D8D32B0F917D3991F3F9E9F7FC606278
                                                                                                                                                                                                                      SHA-256:84A6A5D716724C320B0D1ED08AD1A767B452533D1D7E66FFFA336585DAA506E1
                                                                                                                                                                                                                      SHA-512:E0C75CAE960673C3939C0887AF8837EA0649A35E274200FF3E3820A19DC900D39A763BF5F2E79EF80BA8C8A3054FE855DC887CD91037C459D2B91904D8A91D23
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:import time.from struct import pack..from electrum import ecc.from electrum.i18n import _.from electrum.util import UserCancelled, UserFacingException.from electrum.keystore import bip39_normalize_passphrase.from electrum.bip32 import BIP32Node, convert_bip32_strpath_to_intpath as parse_path.from electrum.logging import Logger.from electrum.plugin import runs_in_hwd_thread.from electrum.plugins.hw_wallet.plugin import OutdatedHwFirmwareException, HardwareClientBase..from trezorlib.client import TrezorClient, PASSPHRASE_ON_DEVICE.from trezorlib.exceptions import TrezorFailure, Cancelled, OutdatedFirmwareError.from trezorlib.messages import WordRequestType, FailureType, RecoveryDeviceType, ButtonRequestType.import trezorlib.btc.import trezorlib.device..MESSAGES = {. ButtonRequestType.ConfirmOutput:. _("Confirm the transaction output on your {} device"),. ButtonRequestType.ResetDevice:. _("Complete the initialization process on your {} device"),. ButtonRequestType.C

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\trezor\cmdline.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):909
                                                                                                                                                                                                                      Entropy (8bit):4.652809271805978
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:1/emAOAtpVBA8nEBcfP466hHvsb/aC9sahfA0y/:demAFdr01vwaCVZG
                                                                                                                                                                                                                      MD5:5E0A672C8DF5259377040713B13891AB
                                                                                                                                                                                                                      SHA1:6032B7262AC9DF8A3FAC7773B9D4A469A6169D14
                                                                                                                                                                                                                      SHA-256:E411C2605E91F0490C74CCBA9CDE8E5A9F798B8561F0F7D55CCD8DAC610AF8A2
                                                                                                                                                                                                                      SHA-512:5A9D028D60134415BDC97E27DEF8D4C570B8BC1DF1845552692FCA596F41FDC1400F488EB2C6BC969EE6316BA6057D303B001A92D30087BDDA24D91075BDBD91
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from electrum.plugin import hook.from electrum.i18n import _.from electrum.util import print_stderr.from .trezor import TrezorPlugin, PASSPHRASE_ON_DEVICE.from ..hw_wallet import CmdLineHandler..class TrezorCmdLineHandler(CmdLineHandler):. def __init__(self):. self.passphrase_on_device = False. super().__init__().. def get_passphrase(self, msg, confirm):. import getpass. print_stderr(msg). if self.passphrase_on_device and self.yes_no_question(_('Enter passphrase on device?')):. return PASSPHRASE_ON_DEVICE. else:. return getpass.getpass('')..class Plugin(TrezorPlugin):. handler = CmdLineHandler(). @hook. def init_keystore(self, keystore):. if not isinstance(keystore, self.keystore_class):. return. keystore.handler = self.handler.. def create_handler(self, window):. return self.handler.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\trezor\qt.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):37455
                                                                                                                                                                                                                      Entropy (8bit):4.635419853213909
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:3GRkbbfsyTrV2lvVSjlmmvi4yL6OaoJa4z1jz:o6bkyTrV2l9SjlmSi4yL6Oaka4z13
                                                                                                                                                                                                                      MD5:B228481C96665FD645EC7A2F79250880
                                                                                                                                                                                                                      SHA1:CD44B61E9766D041AEEC671ED05B88BA328B3BC6
                                                                                                                                                                                                                      SHA-256:EDD0ACEABC10CC40BEC9EA22C6F9CFF1F23259F5D6D6E7A8F10BD835FA6EC119
                                                                                                                                                                                                                      SHA-512:25A2F35ABEF59AD0674984B67F9172B4709CC1F4355218738D3C912EC2F19CD0033431B369AD61FE31767D3AD757C8B427DF3B938889304E2966F55B109940A6
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from functools import partial.import threading.from typing import TYPE_CHECKING..from PyQt5.QtCore import Qt, QEventLoop, pyqtSignal.from PyQt5.QtWidgets import (QVBoxLayout, QLabel, QGridLayout, QPushButton,. QHBoxLayout, QButtonGroup, QGroupBox, QDialog,. QLineEdit, QRadioButton, QCheckBox, QWidget,. QMessageBox, QSlider, QTabWidget)..from electrum.i18n import _.from electrum.logging import Logger.from electrum.plugin import hook.from electrum.keystore import ScriptTypeNotSupported..from electrum.plugins.hw_wallet.qt import QtHandlerBase, QtPluginBase.from electrum.plugins.hw_wallet.plugin import only_hook_if_libraries_available, OutdatedHwFirmwareException..from electrum.gui.qt.util import (WindowModalDialog, WWLabel, Buttons, CancelButton,. OkButton, CloseButton, PasswordLineEdit, getOpenFileName, ChoiceWidget).from electrum.gui.qt.wizard.wallet import WCScriptAndDer

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\trezor\trezor.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):22315
                                                                                                                                                                                                                      Entropy (8bit):4.493298888774816
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:2OWNZzZPTmr861/+j6p8qqZ+d1wSWInNyP:2O+d7mrRx+Op8eGINg
                                                                                                                                                                                                                      MD5:E2F74B1D941CA0077079B86A95674CBD
                                                                                                                                                                                                                      SHA1:3A8F0D9A9083188928BDBEDBF95F562DDBD018A5
                                                                                                                                                                                                                      SHA-256:52AEFB59DA8D95A7A8D79BF5BC458888B4168847AD7076B8CA571CDD63D56EAE
                                                                                                                                                                                                                      SHA-512:AC2C6FE9A994655406B825C7E5B8A60C1A6133981C3E8681D3358985ED06BC21C90E99C7C5681D921E87C9E1EE5A4E336E0664C216983E9ECE80B3C52D58AF89
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from typing import NamedTuple, Any, Optional, TYPE_CHECKING, Sequence..from electrum.util import bfh, UserCancelled, UserFacingException.from electrum.bip32 import BIP32Node.from electrum import descriptor.from electrum import constants.from electrum.i18n import _.from electrum.plugin import Device, runs_in_hwd_thread.from electrum.transaction import Transaction, PartialTransaction, PartialTxInput, Sighash.from electrum.keystore import Hardware_KeyStore.from electrum.logging import get_logger..from electrum.plugins.hw_wallet import HW_PluginBase.from electrum.plugins.hw_wallet.plugin import is_any_tx_output_on_change_branch, \. trezor_validate_op_return_output_and_get_data, LibraryFoundButUnusable, OutdatedHwFirmwareException..if TYPE_CHECKING:. from electrum.plugin import DeviceInfo. from electrum.wizard import NewWalletWizard.._logger = get_logger(__name__)...try:. import trezorlib. import trezorlib.transport. from trezorlib.transport.bridge import BridgeTransport,

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\trustedcoin\__init__.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):427
                                                                                                                                                                                                                      Entropy (8bit):4.980850437894484
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:1YvQJjvMLuk9v+HWTqgKYtKYVnACw/V0dM+:1YIj0Rv+H6qgKAKkw/p+
                                                                                                                                                                                                                      MD5:E66C24ACF8F44F23398D7FDFFFE3649C
                                                                                                                                                                                                                      SHA1:0881088EEC342763265462BDC9CA2814C49F49ED
                                                                                                                                                                                                                      SHA-256:AD34B9362ABE25CB8D30FFF4381557BF26F714011306A3B6A7A9CAA991024DAF
                                                                                                                                                                                                                      SHA-512:A3BA8BF68BB218A4BD5D557DD57F483E737337CF244BBE8D655F0580DCC67E13E20C6C5C67C84C1010DD06EA4D9FB673477A699243B8D64B57DC1A81365D9831
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from electrum.i18n import _..fullname = _('Two Factor Authentication').description = ''.join([. _("This plugin adds two-factor authentication to your wallet."), '<br/>',. _("For more information, visit"),. " <a href=\"https://api.trustedcoin.com/#/electrum-help\">https://api.trustedcoin.com/#/electrum-help</a>".]).requires_wallet_type = ['2fa'].registers_wallet_type = '2fa'.available_for = ['qt', 'cmdline', 'qml'].

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\trustedcoin\cmdline.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1894
                                                                                                                                                                                                                      Entropy (8bit):5.069934641699078
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:UMotJdVlPvLTmawQHlsyHIO5d3D1FLmoJOaCDkfaIiznYiNa0i3S:czPjdwQHzJDTmANSjznTQXi
                                                                                                                                                                                                                      MD5:3CC359BD71D0D159C1F9B786FAF0A059
                                                                                                                                                                                                                      SHA1:7A90F59E2BB4BF9EA234F04EA9338F0178087058
                                                                                                                                                                                                                      SHA-256:D569F1D5F6003ADA5CEFB7B32F0B319DF18F66018DC9058F43C28E0005BDC585
                                                                                                                                                                                                                      SHA-512:556EC5B104C8EF1D61F065DA9DC57077172F9720C78133688913A4CAC0F5DF1FF3355282103D914C31B1B111F5CADA9B1D3FBE5AF94FDE04C647C7B3B945E8C3
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:#!/usr/bin/env python.#.# Electrum - Lightweight Bitcoin Client.# Copyright (C) 2015 Thomas Voegtlin.#.# Permission is hereby granted, free of charge, to any person.# obtaining a copy of this software and associated documentation files.# (the "Software"), to deal in the Software without restriction,.# including without limitation the rights to use, copy, modify, merge,.# publish, distribute, sublicense, and/or sell copies of the Software,.# and to permit persons to whom the Software is furnished to do so,.# subject to the following conditions:.#.# The above copyright notice and this permission notice shall be.# included in all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\trustedcoin\common_qt.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):9525
                                                                                                                                                                                                                      Entropy (8bit):4.463728912000741
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:tALDsa+8Q9ClNoMQhhnNiDliJvBfCfMCsvqCQoC2TCsUCrICgcCdC+BniCsvfCsK:tZKQTRvEfDsv5Qf2Osbr/gzAqhsvqsgZ
                                                                                                                                                                                                                      MD5:94C7B1918CF6851A6088A9C1D4953A55
                                                                                                                                                                                                                      SHA1:086F14E5E860DCE219C26B5E8B938EDCF022E7D9
                                                                                                                                                                                                                      SHA-256:3D6F3BF6DFCAB65DB6AAD597C405FF4A5D6AA5B2A4608F810959A01ED976636C
                                                                                                                                                                                                                      SHA-512:ABA2EE8E8E6D5AF5655EC4139E669EDF0C2EC30901B14F2D3769B8D2456BF3B9D2D53C89F39B6838DC0BBBCC46D5817F50C2D22900B3FC5D2396E029A3CD9188
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:import threading.import socket.import base64.import sys.from typing import TYPE_CHECKING..from electrum.gui.common_qt import get_qt_major_version..if (qt_ver := get_qt_major_version()) == 5:. from PyQt5.QtCore import pyqtSignal, pyqtProperty, pyqtSlot.elif qt_ver == 6:. from PyQt6.QtCore import pyqtSignal, pyqtProperty, pyqtSlot.else:. raise Exception(f"unexpected {qt_ver=}")..from electrum.i18n import _.from electrum.bip32 import BIP32Node..from .trustedcoin import (server, ErrorConnectingServer, MOBILE_DISCLAIMER, TrustedCoinException).from electrum.gui.common_qt.plugins import PluginQObject..if TYPE_CHECKING:. from electrum.wizard import NewWalletWizard...class TrustedcoinPluginQObject(PluginQObject):. canSignWithoutServerChanged = pyqtSignal(). termsAndConditionsRetrieved = pyqtSignal([str], arguments=['message']). termsAndConditionsError = pyqtSignal([str], arguments=['message']). otpError = pyqtSignal([str], arguments=['message']). otpSuccess = pyqtSign

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\trustedcoin\qml.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4438
                                                                                                                                                                                                                      Entropy (8bit):4.542663800780709
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:FmaHbRSMlYf6iEojAToJ1CaQSreVa6rIye8Rbirb0EVk5qw:FQMqf6zodfRyk3+
                                                                                                                                                                                                                      MD5:71B16A8DAA21E4160EB6652E16777949
                                                                                                                                                                                                                      SHA1:CBA87F51104DED30AADB589CDA8DEB51A673E568
                                                                                                                                                                                                                      SHA-256:B8D20D0B69EAE96C4FF3657A3C08BA24DE4D708EF232617631BAE1D0A71E818D
                                                                                                                                                                                                                      SHA-512:E9EF841CA716C50D0FA42FE3214ABC0E157849CF06DCB57B96439FBD0BA15E0E95BDB317AF0EF5D4544C19808A02AD179189E723D1B294287CD8377E6B9CDFDD
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from typing import TYPE_CHECKING..from electrum.i18n import _.from electrum.plugin import hook.from electrum.util import UserFacingException..from electrum.gui.qml.qewallet import QEWallet.from .common_qt import TrustedcoinPluginQObject..from .trustedcoin import TrustedCoinPlugin, TrustedCoinException..if TYPE_CHECKING:. from electrum.gui.qml import ElectrumQmlApplication. from electrum.wallet import Abstract_Wallet. from electrum.wizard import NewWalletWizard...class Plugin(TrustedCoinPlugin):. def __init__(self, *args):. super().__init__(*args).. @hook. def load_wallet(self, wallet: 'Abstract_Wallet'):. if not isinstance(wallet, self.wallet_class):. return. self.logger.debug(f'plugin enabled for wallet "{str(wallet)}"'). if wallet.can_sign_without_server():. self.so._canSignWithoutServer = True. self.so.canSignWithoutServerChanged.emit().. msg = ' '.join([. _('This wallet was rest

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\trustedcoin\qml\ChooseSeed.qml

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):987
                                                                                                                                                                                                                      Entropy (8bit):4.377160104670154
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:I60KU0cWm7HWgAsDXQHsXAEWBsUNf0yTEWBsUG4b:I60KU3W385wEyT5b
                                                                                                                                                                                                                      MD5:1538526A6F8C2B5BBCF41D29176E0033
                                                                                                                                                                                                                      SHA1:5BF872444F9AC66B60F78010211E73260D4C7AAB
                                                                                                                                                                                                                      SHA-256:CAC28FA0E5AB8E92C0D39EE6347A483BF0CC729CC7F4128FF3A9B9E7787A57A0
                                                                                                                                                                                                                      SHA-512:52EB06472FF6D64A2F9434EBDB3A6F531C0B79EE22F06DA1B2F35D461092B0DD9FE95977FC8A9440CB0867969CF5E603DBE2AE7EFE4DCCA731942661935EF304
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:import QtQuick 2.6.import QtQuick.Layouts 1.0.import QtQuick.Controls 2.1..import "../../../gui/qml/components/wizard"..WizardComponent {. valid: keystoregroup.checkedButton !== null.. onAccept: {. wizard_data['keystore_type'] = keystoregroup.checkedButton.keystoretype. }.. ButtonGroup {. id: keystoregroup. }.. ColumnLayout {. width: parent.width. Label {. text: qsTr('Do you want to create a new seed, or restore a wallet using an existing seed?'). Layout.preferredWidth: parent.width. wrapMode: Text.Wrap. }. RadioButton {. ButtonGroup.group: keystoregroup. property string keystoretype: 'createseed'. checked: true. text: qsTr('Create a new seed'). }. RadioButton {. ButtonGroup.group: keystoregroup. property string keystoretype: 'haveseed'. text: qsTr('I already have a seed'). }. }.}..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\trustedcoin\qml\Disclaimer.qml

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):691
                                                                                                                                                                                                                      Entropy (8bit):4.488786222118965
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:IZ3g0KUVwtQdcRIBgoNn8XvWqEZdbUNAkQfavJWpMZewBC3:I60KUOQdcWm9XOqEHbUNAkOUk
                                                                                                                                                                                                                      MD5:7BBE01289D5EF8E1BFD0A228791F9F4A
                                                                                                                                                                                                                      SHA1:16B766B60574DDCC8F240911221833D580850DC4
                                                                                                                                                                                                                      SHA-256:8BFE67D032D999F0A189A2D40D263D4805752DD19D802520CB593C2103492B0F
                                                                                                                                                                                                                      SHA-512:6F53E111053BA0B8FE43B9B6776C57F1D9D30388A496404214B69FCE6FE556F66FA35C7F6FF9453E3E0862C64525A0CE2B1E971DE90370C90AE86F2C285664BE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:import QtQuick 2.6.import QtQuick.Layouts 1.0.import QtQuick.Controls 2.1..import org.electrum 1.0..import "../../../gui/qml/components/wizard"..WizardComponent {. valid: true.. property QtObject plugin.. ColumnLayout {. width: parent.width.. Image {. Layout.alignment: Qt.AlignHCenter. Layout.bottomMargin: constants.paddingLarge. source: '../../../gui/icons/trustedcoin-wizard.png'. }.. Label {. Layout.fillWidth: true. text: plugin ? plugin.disclaimer : ''. wrapMode: Text.Wrap. }. }.. Component.onCompleted: {. plugin = AppController.plugin('trustedcoin'). }.}.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\trustedcoin\qml\KeepDisable.qml

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):869
                                                                                                                                                                                                                      Entropy (8bit):4.480847222564419
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:IZ3g0KU0cRIBgPnvMfsZEgAUoXjWd/qEWQleUcZ708pD8EWQleUcwKmkL:I60KU0cWm8BgAxUCEWBT70bEWBLL
                                                                                                                                                                                                                      MD5:4985A1EF1BE8632AC940FE9870EE1B8C
                                                                                                                                                                                                                      SHA1:124107285D54EFD05F52C3FF8218887EA9782B79
                                                                                                                                                                                                                      SHA-256:D7EBDE437B8C5C7248F976F52DC7B3623BD37E8A8B0EEBF8DAA77FB519E29301
                                                                                                                                                                                                                      SHA-512:F313573375CE56022E6435D77EE84F3B15CCB39BD9DC0EF2C11CA049748F914E97686FED8E30C6093151E2767943B4960015A5F44B338D0EB478DA3338103570
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:import QtQuick 2.6.import QtQuick.Layouts 1.0.import QtQuick.Controls 2.1..import "../../../gui/qml/components/wizard"..WizardComponent {. valid: keepordisablegroup.checkedButton.. function apply() {. wizard_data['trustedcoin_keepordisable'] = keepordisablegroup.checkedButton.keepordisable. }.. ButtonGroup {. id: keepordisablegroup. onCheckedButtonChanged: checkIsLast(). }.. ColumnLayout {. Label {. text: qsTr('Restore 2FA wallet'). }. RadioButton {. ButtonGroup.group: keepordisablegroup. property string keepordisable: 'keep'. checked: true. text: qsTr('Keep'). }. RadioButton {. ButtonGroup.group: keepordisablegroup. property string keepordisable: 'disable'. text: qsTr('Disable'). }. }.}.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\trustedcoin\qml\ShowConfirmOTP.qml

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4228
                                                                                                                                                                                                                      Entropy (8bit):4.394171154362271
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:L0S5y4rPp1r+0Tb5r+heUrZ80v4KmLUYCU8SaoP9QHX3DsDCdcNsb:IS5LPpV+0Ttr+heUrZ80gKmgYCU8RhHb
                                                                                                                                                                                                                      MD5:9579E86B3DBAAFDB82E23ACDDECDCFEB
                                                                                                                                                                                                                      SHA1:F0DC65BB4D4AACDEFF7287CE786213D3BAB612F6
                                                                                                                                                                                                                      SHA-256:8076B6213C037DE30FD588095416310CB3FE996CB59D0EEBF4F32902E8C93ED4
                                                                                                                                                                                                                      SHA-512:2C594258B345033710776F3CA00A621895E82A274E09A92A56D587D8458A89E84A68FFDD8BA8084429FFA95CF424E1BDFF892910716B0D9922899FBC50EB9CB8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:import QtQuick 2.6.import QtQuick.Layouts 1.0.import QtQuick.Controls 2.1..import "../../../gui/qml/components/wizard".import "../../../gui/qml/components/controls"..WizardComponent {. valid: otpVerified.. property QtObject plugin.. property bool otpVerified: false.. ColumnLayout {. width: parent.width.. Label {. text: qsTr('Authenticator secret'). }.. InfoTextArea {. id: errorBox. Layout.fillWidth: true. iconStyle: InfoTextArea.IconStyle.Error. visible: !otpVerified && plugin.remoteKeyState == 'error'. }.. InfoTextArea {. Layout.fillWidth: true. iconStyle: InfoTextArea.IconStyle.Warn. visible: plugin.remoteKeyState == 'wallet_known'. text: qsTr('This wallet is already registered with TrustedCoin. '). + qsTr('To finalize wallet creation, please enter your Google Authenticator Code. '). }.. QRImage {.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\trustedcoin\qml\Terms.qml

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1664
                                                                                                                                                                                                                      Entropy (8bit):4.147635049972669
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:I60KUOQdcWmcQ2HG5C+tEBAETFrXVAgXENHtP1eyUxGZSzAzCSAT8FCcCSiXL:I60KUOFWNpHBL3Ag0hBoyXyICjXL
                                                                                                                                                                                                                      MD5:07F02079D50F78DA217FD0AE27EDE2C1
                                                                                                                                                                                                                      SHA1:3007E9769D5C3F2CABAF9982A4702938B1EA7175
                                                                                                                                                                                                                      SHA-256:4F7AD2042911BE29B1341B69BFCF9B96F3A07365ED411442343A8CC52E997FC3
                                                                                                                                                                                                                      SHA-512:5BEDDBD8C6EBC17B12D6A57C9D9DB0FA5B873EFB51AFCBB7FCEB9CA02DDE0FBFC0840BEAADABC1C5B9DB61426F35A9EED73B5B1B79133E828055573D67E0EEB7
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:import QtQuick 2.6.import QtQuick.Layouts 1.0.import QtQuick.Controls 2.1..import org.electrum 1.0..import "../../../gui/qml/components/wizard".import "../../../gui/qml/components/controls"..WizardComponent {. valid: !plugin ? false. : tosShown.. property QtObject plugin. property bool tosShown: false.. ColumnLayout {. anchors.fill: parent.. Label {. text: qsTr('Terms and conditions'). }.. TextHighlightPane {. Layout.fillWidth: true. Layout.fillHeight: true. rightPadding: 0.. Flickable {. anchors.fill: parent. contentHeight: termsText.height. clip: true. boundsBehavior: Flickable.StopAtBounds.. Label {. id: termsText. width: parent.width. rightPadding: constants.paddingSmall. wrapMode: Text.Wrap. }.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\trustedcoin\qt.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):24354
                                                                                                                                                                                                                      Entropy (8bit):4.699928000787684
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:Ro6St2QXexCeNDjm8A0pNtF/UqtaOugBbIXXFoqLLfvfsUNkjdNRHl:26StdteZjmv8NtF8qtaBJ7nJNKp
                                                                                                                                                                                                                      MD5:4B4548ACD84386EB9D092BECEA908A14
                                                                                                                                                                                                                      SHA1:DFF4485F5FD2F7AF6C33AC429E2DB2887016096A
                                                                                                                                                                                                                      SHA-256:777323D8B9678A96D5AF3999572D5DDF95C36A91771A24D5146907E1EA7DA345
                                                                                                                                                                                                                      SHA-512:B678870C6972B566E8FC6FE2A3C9F5031F00B1F0658DC4DBD8A1303BE0302AE9FCCE8B87A3B88FEDD5318D85E0FD6E79F3F418B687D5A04844478BD57BAE31D2
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:#!/usr/bin/env python.#.# Electrum - Lightweight Bitcoin Client.# Copyright (C) 2015 Thomas Voegtlin.#.# Permission is hereby granted, free of charge, to any person.# obtaining a copy of this software and associated documentation files.# (the "Software"), to deal in the Software without restriction,.# including without limitation the rights to use, copy, modify, merge,.# publish, distribute, sublicense, and/or sell copies of the Software,.# and to permit persons to whom the Software is furnished to do so,.# subject to the following conditions:.#.# The above copyright notice and this permission notice shall be.# included in all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\trustedcoin\trustedcoin.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):27622
                                                                                                                                                                                                                      Entropy (8bit):4.672349210966519
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:cdwQHdx9KlVQIxD2B0wp+dIJ1ich38ppDdMhvlhpMWqhud+RTL58bX0HGTsK1A0L:RoixxSDofZTL5MhsFb355lfbOMcV
                                                                                                                                                                                                                      MD5:C7012BDAF5468CAECF1D755E76591489
                                                                                                                                                                                                                      SHA1:AF6124794CED1CE440519A6A3515853BBE1633A5
                                                                                                                                                                                                                      SHA-256:F147B9073BFE678A99861B7624084423EE3A8426A84EAF951BAF83A4C9BCDCE4
                                                                                                                                                                                                                      SHA-512:4154DFB6BE1B4DF712DA565ACE2455151C13C863B8D3921A05C406E594C5442E2E65F89C50F49285859D940FE59161D0FBA06CFA04F2423A40633E848BAB0AFB
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:#!/usr/bin/env python.#.# Electrum - Lightweight Bitcoin Client.# Copyright (C) 2015 Thomas Voegtlin.#.# Permission is hereby granted, free of charge, to any person.# obtaining a copy of this software and associated documentation files.# (the "Software"), to deal in the Software without restriction,.# including without limitation the rights to use, copy, modify, merge,.# publish, distribute, sublicense, and/or sell copies of the Software,.# and to permit persons to whom the Software is furnished to do so,.# subject to the following conditions:.#.# The above copyright notice and this permission notice shall be.# included in all copies or substantial portions of the Software..#.# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.# NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS.# BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\virtualkeyboard\__init__.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):242
                                                                                                                                                                                                                      Entropy (8bit):4.814099320310534
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:1YvQ7rhwQPVnda5u14Afv8gj5XtzTLZYvuTgXlWGVrIr:1YvQJlu5u2AfJtpLauucGV0r
                                                                                                                                                                                                                      MD5:C2FC53DA569BBAEE6CBCB27F3746CE0B
                                                                                                                                                                                                                      SHA1:0B7C01AFBC0EA31165FF39320E07000E573D1B93
                                                                                                                                                                                                                      SHA-256:5EF1742F961BC7CBF3961A0E06CCFC58187D5D41F385309A73153C3524B7A273
                                                                                                                                                                                                                      SHA-512:1C27B5476B1DF445609200B89711D5D0E3F524B11B1E146FB693B3B05B9446F019FA768C06348CFB11278DB18F80B791539AB9EFC1148361CD524BD9C545B3B1
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:from electrum.i18n import _..fullname = 'Virtual Keyboard'.description = '%s\n%s' % (_("Add an optional virtual keyboard to the password dialog."), _("Warning: do not use this if it makes you pick a weaker password.")).available_for = ['qt'].

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\plugins\virtualkeyboard\qt.py

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Python script, ASCII text executable
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1989
                                                                                                                                                                                                                      Entropy (8bit):4.69457366463934
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:Q6ReyWw9TzjWZEWKX1uT0/aHm96OHPSJds:b0yWUiq/2Ta6Pds
                                                                                                                                                                                                                      MD5:48FBF4FD09D00CEBF3C2970F7F803476
                                                                                                                                                                                                                      SHA1:5AD56DC851A74A39EF3082988060DDEBA7FCE10C
                                                                                                                                                                                                                      SHA-256:0937910B1C26B9240D39C6FFB5A424AD7C9FE3C3B807147AD3F4B84ED62809D2
                                                                                                                                                                                                                      SHA-512:A371C5ECA125DFC85BD367C0F7B89F7AC98E3ED6B8AAA2E4DBDAFACF92E47BF6311DD8FF5DA56D970AA58868D0386F87E10954238251ED6C5A3158AC6B605411
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:import random..from PyQt5.QtWidgets import (QVBoxLayout, QGridLayout, QPushButton).from PyQt5.QtGui import QFontMetrics..from electrum.plugin import BasePlugin, hook.from electrum.i18n import _...class Plugin(BasePlugin):. vkb = None. vkb_index = 0.. @hook. def password_dialog(self, pw, grid, pos):. vkb_button = QPushButton("+"). font_height = QFontMetrics(vkb_button.font()).height(). vkb_button.setFixedWidth(round(1.7 * font_height)). vkb_button.clicked.connect(lambda: self.toggle_vkb(grid, pw)). grid.addWidget(vkb_button, pos, 2). self.kb_pos = 2. self.vkb = None.. def toggle_vkb(self, grid, pw):. if self.vkb:. grid.removeItem(self.vkb). self.vkb = self.virtual_keyboard(self.vkb_index, pw). grid.addLayout(self.vkb, self.kb_pos, 0, 1, 3). self.vkb_index += 1.. def virtual_keyboard(self, i, pw):. i = i % 3. if i == 0:. chars = 'abcdefghijklmnopqrstuvwxyz '.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\servers.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):10498
                                                                                                                                                                                                                      Entropy (8bit):4.0827969081007405
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:w/AJ9+NTen0vi0KIYxPkv5gAb1q4h6t/FA06FLWZoOW6BrxFie3UG0jpr6MdRgGd:cBCcP/V
                                                                                                                                                                                                                      MD5:FCBF1CC8CF6A61B5729A1A78293C5D66
                                                                                                                                                                                                                      SHA1:56F37B925043391EB8987FBFC3614FBD6C53C51F
                                                                                                                                                                                                                      SHA-256:5B320E11B6AF674AB93C7FD2D89EA303A3A60634C4FBE3C8FB058DD4EF6BEAD3
                                                                                                                                                                                                                      SHA-512:B7D5C1A1AA55B3BC537EDA3CF610F969D4EF3883127A911888E2A5BA201D51D53B0FB783B588A97A2EC3ED73F353C3AAFBF99478FCCFC3666DCDCA42FC0C35C5
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{. "104.248.139.211": {. "pruning": "-",. "s": "50002",. "t": "50001",. "version": "1.4.2". },. "128.0.190.26": {. "pruning": "-",. "s": "50002",. "version": "1.4.2". },. "142.93.6.38": {. "pruning": "-",. "s": "50002",. "t": "50001",. "version": "1.4.2". },. "157.245.172.236": {. "pruning": "-",. "s": "50002",. "t": "50001",. "version": "1.4.2". },. "159.65.53.177": {. "pruning": "-",. "t": "50001",. "version": "1.4.2". },. "167.172.42.31": {. "pruning": "-",. "s": "50002",. "t": "50001",. "version": "1.4.2". },. "188.230.155.0": {. "pruning": "-",. "s": "50002",. "t": "50001",. "version": "1.4.2". },. "22mgr2fndslabzvx4sj7ialugn2jv3cfqjb3dnj67a6vnrkp7g4l37ad.onion": {. "pruning": "-",. "t": "50001",. "version": "1.4.2". },. "2AZZARITA

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\servers_regtest.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):122
                                                                                                                                                                                                                      Entropy (8bit):3.4854012322496546
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3:34QWFnXe5topFFF8HRF7HkBXF52S1kvNiAvn:3sA56+HIqS1kwAv
                                                                                                                                                                                                                      MD5:FAE0E5714B66267E656500A0766784AC
                                                                                                                                                                                                                      SHA1:B5078FE5B0F6B5E81C759A322684D74AF3B72F95
                                                                                                                                                                                                                      SHA-256:5018BE2D11F596DF37E19F9AD0581D66C22C6D1F50B2BA1F4AFBFA32DED922A7
                                                                                                                                                                                                                      SHA-512:9832E3C6EC7609481F36573EA987972B80B41F64CA650B14D5AB9BC1173708F354BEC8A5DAFD65CF8323BA0B79B37DBF4F1E952FA8B4D89369BE2D20E7966B2C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{. "127.0.0.1": {. "pruning": "-",. "s": "51002",. "t": "51001",. "version": "1.4". }.}.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\servers_signet.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):366
                                                                                                                                                                                                                      Entropy (8bit):3.8609658916403737
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:3sA56+HIqS1kwL0OAGu8A56+uuUcS1kwLiOq0cfFwA56+V8S1kwAv:L6z1kwq16r/1kw2f0ctn6Qf1kwK
                                                                                                                                                                                                                      MD5:27CC53FE12321059F03077930CD08D4B
                                                                                                                                                                                                                      SHA1:56BBF7DA37D7EC3BFA30144746C47A5571790897
                                                                                                                                                                                                                      SHA-256:0502A5A5C6ECC5BB89B6FD4987031BA72B94843E7149A226D3A7AD197117B230
                                                                                                                                                                                                                      SHA-512:E92BCFCBC028F8960E5086042096DCD8B39B7E30412DF2016909C323199C292118A407ED84291C3DC6240938EAB861E1DEFEC84341ED932BE1E03F60718526E7
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{. "127.0.0.1": {. "pruning": "-",. "s": "51002",. "t": "51001",. "version": "1.4". },. "signet-electrumx.wakiyamap.dev": {. "pruning": "-",. "s": "50002",. "t": "50001",. "version": "1.4". },. "electrum.emzy.de": {. "pruning": "-",. "s": "53002",. "version": "1.4". }.}.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\servers_testnet.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1031
                                                                                                                                                                                                                      Entropy (8bit):4.021117622225254
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:4J40d1oQQf8I1P2v8A1P2I2YY1PrZQ1oA9xe1oAjQ18WP1K1PK:4J40nop8w+UI+CA1YoYCoyYnP1mS
                                                                                                                                                                                                                      MD5:7EDE5F010661C804BC862C078E4514C0
                                                                                                                                                                                                                      SHA1:48A7B56E2CAFF7C35C37541417E568E04C9130C6
                                                                                                                                                                                                                      SHA-256:CD6BD116AF89B8DE77AD0A1A68A91672F0A219E39061A9CE324685D7652D4EA7
                                                                                                                                                                                                                      SHA-512:0BF5283C0E713BCA7D58E5CDE4CC5B03F276F5C4D12862EB806EAB2B2E3C88FD8DD6CC6F64AEFAE06601927A24D5393EDF6A2AE237E6EC47FD5407EA8A9B62C4
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{. "blackie.c3-soft.com": {. "pruning": "-",. "s": "57006",. "t": "57005",. "version": "1.4.5". },. "blockstream.info": {. "pruning": "-",. "s": "993",. "t": "143",. "version": "1.4". },. "electrum.blockstream.info": {. "pruning": "-",. "s": "60002",. "t": "60001",. "version": "1.4". },. "explorerzydxu5ecjrkwceayqybizmpjjznk5izmitf2modhcusuqlid.onion": {. "pruning": "-",. "t": "143",. "version": "1.4". },. "testnet.aranguren.org": {. "pruning": "-",. "s": "51002",. "t": "51001",. "version": "1.4.2". },. "testnet.hsmiths.com": {. "pruning": "-",. "s": "53012",. "version": "1.4.2". },. "testnet.qtornado.com": {. "pruning": "-",. "s": "51002",. "t": "51001",. "version": "1.5". },. "tn.not.fyi": {. "pruning": "-",. "s": "55002",. "t": "55001",.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\wordlist\english.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):13116
                                                                                                                                                                                                                      Entropy (8bit):4.2192956006819475
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:DAvLtKog3W8jiD1/oLpsExUKqlyjn6SybkSoxIFg/7mSX30hB8OnqdE5HpF2gS2:MvLAog/I1wdsExXxigaSUvRj5r
                                                                                                                                                                                                                      MD5:F23506956964FA69C98FA3FB5C8823B5
                                                                                                                                                                                                                      SHA1:B2D5241AE027A0E40F06A33D909809A190F210FE
                                                                                                                                                                                                                      SHA-256:2F5EED53A4727B4BF8880D8F3F199EFC90E58503646D9FF8EFF3A2ED3B24DBDA
                                                                                                                                                                                                                      SHA-512:416C71BA30018EA292BB36CDC23C9329673485A8D8933266A9D9A7CC72153B8BAED3D430F52EAB4F5D3ADDF6583611B3777A50454599F1E42716F5F879621123
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:abandon.ability.able.about.above.absent.absorb.abstract.absurd.abuse.access.accident.account.accuse.achieve.acid.acoustic.acquire.across.act.action.actor.actress.actual.adapt.add.addict.address.adjust.admit.adult.advance.advice.aerobic.affair.afford.afraid.again.age.agent.agree.ahead.aim.air.airport.aisle.alarm.album.alcohol.alert.alien.all.alley.allow.almost.alone.alpha.already.also.alter.always.amateur.amazing.among.amount.amused.analyst.anchor.ancient.anger.angle.angry.animal.ankle.announce.annual.another.answer.antenna.antique.anxiety.any.apart.apology.appear.apple.approve.april.arch.arctic.area.arena.argue.arm.armed.armor.army.around.arrange.arrest.arrive.arrow.art.artefact.artist.artwork.ask.aspect.assault.asset.assist.assume.asthma.athlete.atom.attack.attend.attitude.attract.auction.audit.august.aunt.author.auto.autumn.average.avocado.avoid.awake.aware.away.awesome.awful.awkward.axis.baby.bachelor.bacon.badge.bag.balance.balcony.ball.bamboo.banana.banner.bar.barely.bargain.barre

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\electrum\wordlist\slip39.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:C source, ASCII text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7231
                                                                                                                                                                                                                      Entropy (8bit):4.235985120108038
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:go28rtOqlnqd1su9Jgubann5D1fN2J4kmeY3:A8saqDbbIn5DNoJ4kO
                                                                                                                                                                                                                      MD5:BF2027501393E153341E01B46BDF4A3B
                                                                                                                                                                                                                      SHA1:650C1DF1DA9BD5499DD951837B45EBBB738AF82A
                                                                                                                                                                                                                      SHA-256:BCC4555340332D169718AED8BF31DD9D5248CB7DA6E5D355140EF4F1E601EEC3
                                                                                                                                                                                                                      SHA-512:57F1A57BE2EDA50E923D6C3766612745E2B22F14C16B683376F120E1FBB4F15D1C3E58CEEA9D4B3D3871A7FFAE94A1AB7AFD2E69CBFD53CC55A9A1C87CC586F6
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:academic.acid.acne.acquire.acrobat.activity.actress.adapt.adequate.adjust.admit.adorn.adult.advance.advocate.afraid.again.agency.agree.aide.aircraft.airline.airport.ajar.alarm.album.alcohol.alien.alive.alpha.already.alto.aluminum.always.amazing.ambition.amount.amuse.analysis.anatomy.ancestor.ancient.angel.angry.animal.answer.antenna.anxiety.apart.aquatic.arcade.arena.argue.armed.artist.artwork.aspect.auction.august.aunt.average.aviation.avoid.award.away.axis.axle.beam.beard.beaver.become.bedroom.behavior.being.believe.belong.benefit.best.beyond.bike.biology.birthday.bishop.black.blanket.blessing.blimp.blind.blue.body.bolt.boring.born.both.boundary.bracelet.branch.brave.breathe.briefing.broken.brother.browser.bucket.budget.building.bulb.bulge.bumpy.bundle.burden.burning.busy.buyer.cage.calcium.camera.campus.canyon.capacity.capital.capture.carbon.cards.careful.cargo.carpet.carve.category.cause.ceiling.center.ceramic.champion.change.charity.check.chemical.chest.chew.chubby.cinema.civil.cl

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\hid.cp310-win32.pyd

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):78336
                                                                                                                                                                                                                      Entropy (8bit):6.396606725288797
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:sRqRTyvCslycXWmiWEV7xZaGlgEyz0e3pCG:GmOvLMYWmUV3VgEyz0
                                                                                                                                                                                                                      MD5:084F1A8DB3FDF6520F6B63D7489B1971
                                                                                                                                                                                                                      SHA1:6A4855600B7EE4D387296D3952B005BCF4770DD2
                                                                                                                                                                                                                      SHA-256:59E478CB62FFEAF7B3EACB59B3BB94C3225E3307B2CB2370FAAB55C3B99E93C7
                                                                                                                                                                                                                      SHA-512:097A91821B52ACE69203DF03588E9D419979B308A592B1359386818C61FAC930743D4875E883377F4B21ABF3B8DC5CD51C444395AD61EF424201398F96C57C2E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........>a..P2..P2..P2...2..P2..Q3..P2..Q3..P2..U3..P2..T3..P2..S3..P26.Q3..P2..Q2K.P2C.X3..P2C.P3..P2C.2..P2C.R3..P2Rich..P2................PE..L...R7sd...........!...".....p............................................................@............................. ............P.......................`......X...................................@............................................text............................... ..`.rdata...9.......:..................@..@.data.... ... ......................@....rsrc........P......................@..@.reloc.......`....... ..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\is_portable

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3367
                                                                                                                                                                                                                      Entropy (8bit):4.435554698905691
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:ka4SL+xPTUNht6XGAGNSsXD/L0pmVVaYXYQL6CTp47Uobw4iZRm:ka4++xb+ht6fGYsnIcLlTG7bGm
                                                                                                                                                                                                                      MD5:0FE365C47118A3E3689A6A316CB2CA27
                                                                                                                                                                                                                      SHA1:9D36FE2F26D3ADF811C1D16ED8EA424957BF889F
                                                                                                                                                                                                                      SHA-256:2ABBA93AA2E00C4B698AB37DB2745417FE2069779A5F91A945B86227272E1AD0
                                                                                                                                                                                                                      SHA-512:A4F8BB5D8B7294CABFEF9EE9FE1368E15A3328C915EB543785B080310F52FC8BB2259794DBCDA21A6E51F4E0345D3A2FB25BCB64EED94BDD707B2B55EFCCC429
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:# Windows binaries... _These binaries should be reproducible, meaning you should be able to generate. binaries that match the official releases._..This assumes an Ubuntu (x86_64) host, but it should not be too hard to adapt to another.similar system...1. Install Docker.. See [`contrib/docker_notes.md`](../docker_notes.md)... (worth reading even if you already have docker).. Note: older versions of Docker might not work well. (see [#6971](https://github.com/spesmilo/electrum/issues/6971)).. If having problems, try to upgrade to at least `docker 20.10`...2. Build Windows binaries.. ```. $ ./build.sh. ```. If you want reproducibility, try instead e.g.:. ```. $ ELECBUILD_COMMIT=HEAD ./build.sh. ```..3. The generated binaries are in `./contrib/build-wine/dist`.....## Code Signing..Electrum Windows builds are signed with a Microsoft Authenticode. code signing.certificate in addition to the GPG-based signatures...The advantage of using Authenticode is

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\libcrypto-1_1.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2276120
                                                                                                                                                                                                                      Entropy (8bit):6.111762453951637
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:49152:3L7Iy5xntVyJSFtv3A8+QK1CPwDv3uFfJKShr:3L7Iy59nFdA8m1CPwDv3uFfJK+
                                                                                                                                                                                                                      MD5:4633D62F19C0B25318B1C612995F5C21
                                                                                                                                                                                                                      SHA1:50601F9E2B07D616FDE8EE387CE8CDCB0CA451DF
                                                                                                                                                                                                                      SHA-256:47376D247AE6033BC30FEE4E52043D3762C1C0C177E3EC27CA46EFF4B95C69B0
                                                                                                                                                                                                                      SHA-512:D6A18E43B1A20242F80265054ED8D33598439FFA5DF4920931FF43EC91F1AC2D8A3931913FD5569F48C9B1B9EA845D9E017EA23571A1AC1B352502A3E823ECA9
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8..uk..uk..uk...k..uk..tj..uk..pj..uk..qj..uk..vj..uk..tko.uk..tj..uk2.qjs.uk2.uj..uk2..k..uk2.wj..ukRich..uk........PE..L......c...........!...".(...........g.......@................................#.....8."...@.........................`....h....!.T.....".|............."../....".4.......8...............................@.............!..............................text....&.......(.................. ..`.rdata..v*...@...,...,..............@..@.data...TY...p!......X!.............@....idata........!......n!.............@..@.00cfg........!.......!.............@..@.rsrc...|.....".......!.............@..@.reloc........".......!.............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\libffi-7.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):29208
                                                                                                                                                                                                                      Entropy (8bit):6.643623418348
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:l69PtXvz8cLBN3gHhY4AFlfIvDzqig2c2LuRRClfW23JLURlV5uH+6nYPLxDG4yG:l65tXvz2CTIvy2c26A35qYvWDG4yG
                                                                                                                                                                                                                      MD5:BC20614744EBF4C2B8ACD28D1FE54174
                                                                                                                                                                                                                      SHA1:665C0ACC404E13A69800FAE94EFD69A41BDDA901
                                                                                                                                                                                                                      SHA-256:0C7EC6DE19C246A23756B8550E6178AC2394B1093E96D0F43789124149486F57
                                                                                                                                                                                                                      SHA-512:0C473E7070C72D85AE098D208B8D128B50574ABEBBA874DDA2A7408AEA2AABC6C4B9018801416670AF91548C471B7DD5A709A7B17E3358B053C37433665D3F6B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)..qm.."m.."m.."d.p"o.."?..#o.."...#n.."m.."I.."?..#f.."?..#g.."?..#n.."...#k.."...#l.."...#l.."...#l.."Richm.."................PE..L.....]...........!.....@...........E.......P......................................H.....@.........................pU.......X..P....................X.......p..<....R..............................0R..@............P...............................text...j>.......@.................. ..`.rdata..p....P.......D..............@..@.data........`.......R..............@....reloc..<....p.......T..............@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\libsecp256k1-2.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1235470
                                                                                                                                                                                                                      Entropy (8bit):7.95655528950463
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24576:7c/LDeIWs9GsChyXuRtANMoQRELx/pYuhIe57Low7XH5rs:WnWs0YGANMoywHhSC7LPzG
                                                                                                                                                                                                                      MD5:E55B6EE4A4672BBA643ED67D8D01A624
                                                                                                                                                                                                                      SHA1:ACD4D800392CAA6E8A5D2C40470A80226CBCED04
                                                                                                                                                                                                                      SHA-256:801933DB9388286C6791E465AB1A0FE386970486F7AB8A007580BBB853CB6283
                                                                                                                                                                                                                      SHA-512:ED4B5845795C5E3905D59468BBA8AA0E9B3C3DB88AFCFAFE092C216D5066CB4A8819C17DC8196991C043E4BA615E02E4F829C21617536010438796A5E6E619C8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#...#...........................k.........................P......e......... .................................l............................@..`....................................................................................text...............................`.P`.data...0...........................@.0..rdata..t...........................@.`@/4......l#.......$..................@.0@.bss..................................0..edata..............................@.0@.idata..l...........................@.0..CRT....,.... ......................@.0..tls.........0......................@.0..reloc..`....@......................@.0B................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\libssl-1_1.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):552216
                                                                                                                                                                                                                      Entropy (8bit):5.779566253639773
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12288:MaYPTKwDsuz9V/9SYeujF59CF5e3SnEEATLU2lvzS7u:nYPTRDD9ND58GqbATLU2lvzS7u
                                                                                                                                                                                                                      MD5:8845FCF1AE2DE1018DAAAEA01D9BA2D5
                                                                                                                                                                                                                      SHA1:DB67697EE052738E6F23CC1D29B261BEF1D423E5
                                                                                                                                                                                                                      SHA-256:B7E16AF3EFF9AB0869CFE60C256394A70A867879B7F56544A724D6AC1CCFAB88
                                                                                                                                                                                                                      SHA-512:2792FE94DD35B594514C4FAD091C9683EC47814335D046F776CD1F043C576533E99088949F1F1AE6814C16DBDDA430EC53B2D64621EA0C818CADB91EC5E3A788
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<...x.._x.._x.._qf._t.._7b.^z.._3f.^z.._7b.^s.._7b.^r.._7b.^z.._.b.^{.._x.._..._.b.^T.._.b.^y.._.ba_y.._.b.^y.._Richx.._........................PE..L......c...........!...".....4......."....... ......................................P.....@......................... =...N...........0..s............>.../...@...6...,..8............................+..@............................................text...-........................... ..`.rdata..*k... ...l..................@..@.data....;.......6...|..............@....idata..dA.......B..................@..@.00cfg....... ......................@..@.rsrc...s....0......................@..@.reloc..)>...@...@..................@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\libusb-1.0.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):219662
                                                                                                                                                                                                                      Entropy (8bit):6.498800717506742
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:yL40BTtebjPofSJqYtdKZMy4ZKmJo5RFjXPicaW/jmkfEc7fNQ8juEnLQLyE:yXujMSgYtUZMy4ZKmJ2RFjXT/jmglB2
                                                                                                                                                                                                                      MD5:F4A98FEA2565D76FC7AEE8195F955CD0
                                                                                                                                                                                                                      SHA1:6FBBF899BA474419E21042CF81D7D9D4F12F1040
                                                                                                                                                                                                                      SHA-256:E70158FEF09E1B5EE8BB416EC4F3ADA620C06E0ED54C44E850572E99863F43C3
                                                                                                                                                                                                                      SHA-512:3A4987994A93F487782C89D8645CEF399D4AE21CEA75D36B9FD5E2ADC0253B3E975D947E73C046DE44BED99D0670E6E14BCB1F1EFD751FC9CCB0888B8A3A929B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........Z.........#...#.@...V...............P.....k................................=:........ ......................@.......`..$....................................................................................a...............................text....>.......@..................`.P`.data........P.......D..............@.`..rdata.......`.......H..............@.`@/4.......6.......8..................@.0@.bss.........0........................`..edata.......@... ..................@.0@.idata..$....`.......(..............@.0..CRT....,....p.......4..............@.0..tls.................6..............@.0..rsrc................8..............@.0..reloc...............>..............@.0B........................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\libzbar-0.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):281102
                                                                                                                                                                                                                      Entropy (8bit):6.455757924389761
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6144:0nbKPzmx2iUlsLt1LaOdfPyb5Zrziwis7q63lI:0nbKPzmx2iUlsLHiH571lI
                                                                                                                                                                                                                      MD5:042DA22F1B7CF72B878A62A0DB6C6080
                                                                                                                                                                                                                      SHA1:6EEB12444A784E3469820AE7D4326382DBCC1DEE
                                                                                                                                                                                                                      SHA-256:FBDC809E73A718ACDF291393223F1516F517CC3C2A5C2F0F4FFC26E0C8D9CCBA
                                                                                                                                                                                                                      SHA-512:34CF16461FCD9C0AC996C5CA4BE1D7277F770364928195A261AC516B4669376E87F0F891D2C198ECE5FF03B41193EF1B544FA0902A6528E361FADF9557E95801
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........J.........#...#.8...F...............P.....j......................................... ......................0.......P................................... ..................................................TS...............................text...$6.......8..................`.P`.data........P.......<..............@.`..rdata...Z...`...\...J..............@.`@/4.......P.......R..................@.0@.bss......... ........................`..edata.......0......................@.0@.idata.......P......................@.0..CRT....0....p....... ..............@.0..tls................."..............@.0..rsrc................$..............@.0..reloc... ......."...(..............@.0B........................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\mnemonic\py.typed

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):27
                                                                                                                                                                                                                      Entropy (8bit):3.9265716511782736
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3:SZeW0FOoc:SZeRFHc
                                                                                                                                                                                                                      MD5:48734178084EF7F5C250997C28F8BDEE
                                                                                                                                                                                                                      SHA1:4D7BB7A1D9B08B32C6FFBAFCE440959D0BC19788
                                                                                                                                                                                                                      SHA-256:6D67B0F661E0332F0BA8CBBB46EA905C55CB071876091C747546D2C7EDF0138F
                                                                                                                                                                                                                      SHA-512:A227E9E2B7FC025767B4363544B4C4A675A123A853E68C740E659E662C354030F655B8FDA1D6CDF57B58CCA32A4757195F76D7A4A93048D334F047E7693F3335
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:# Marker file for PEP 561..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\mnemonic\wordlist\chinese_simplified.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):8192
                                                                                                                                                                                                                      Entropy (8bit):5.097279386012455
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:RC/PE+flkDFk4kVOAUAIXYP9laqCFd5zJ007:R4E65uYPVCFLzJ
                                                                                                                                                                                                                      MD5:0C5517AB8EDB22EA7A61E44B28E96DA7
                                                                                                                                                                                                                      SHA1:F902EE7E96CE48DE6404ADF644FA40E260D949FF
                                                                                                                                                                                                                      SHA-256:5C5942792BD8340CB8B27CD592F1015EDF56A8C5B26276EE18A482428E7C5726
                                                                                                                                                                                                                      SHA-512:F5B6D696A6B75BDEEACD0E0742D31EAA06CD683BB3C149052D82E0D47039534B23C82FC47FB193C86FF2B7C2B22F73CCC48CC500F09ABC5E228998D9BC413EF7
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\mnemonic\wordlist\chinese_traditional.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):8192
                                                                                                                                                                                                                      Entropy (8bit):5.099678321615091
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:UPmINi9ODjMzdZmIBI3C8+o95uECRdDGrRPY2+PDv:Ucfz7lqyHo9RCz2wLPDv
                                                                                                                                                                                                                      MD5:00D0909E346B52006D1E9EF680B5A5FC
                                                                                                                                                                                                                      SHA1:33E401BEA63F83A5EA84D78DDC7161809EF77F0B
                                                                                                                                                                                                                      SHA-256:417B26B3D8500A4AE3D59717D7011952DB6FC2FB84B807F3F94AC734E89C1B5F
                                                                                                                                                                                                                      SHA-512:1E2689A48317A12A6B4A6A74DE2241380FEF57B250FAFE6AB00A479DB85D12661F8C33749240C9CEC6535ACD7F91E71DCBA0BB8A27D1D32A3B76FE34797CAD5B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\mnemonic\wordlist\czech.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):14945
                                                                                                                                                                                                                      Entropy (8bit):4.229683397391918
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:6kfPbFvdXqyyLlY3fIVKj7KyvKxv/FjZ305yyRvQcR5bJw:lbrXqyyLS31/Kyviv/FaAyttR59w
                                                                                                                                                                                                                      MD5:38FD5E100D4604C2A844BB9BB9305975
                                                                                                                                                                                                                      SHA1:33A09B9BC987AAA8560FFEF8A17459C99C63ED4A
                                                                                                                                                                                                                      SHA-256:7E80E161C3E93D9554C2EFB78D4E3CEBF8FC727E9C52E03B83B94406BDCC95FC
                                                                                                                                                                                                                      SHA-512:3D56A9D507B5B07A99B9D9924D8540944DD226D4B5050852027F09309A85513DB2E57C9186F70B8F8226C342C28EFCEDD1E8EDD507E1D39F8DA693CFAC0C39CA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:abdikace.abeceda.adresa.agrese.akce.aktovka.alej.alkohol.amputace.ananas.andulka.anekdota.anketa.antika.anulovat.archa.arogance.asfalt.asistent.aspirace.astma.astronom.atlas.atletika.atol.autobus.azyl.babka.bachor.bacil.baculka.badatel.bageta.bagr.bahno.bakterie.balada.baletka.balkon.balonek.balvan.balza.bambus.bankomat.barbar.baret.barman.baroko.barva.baterka.batoh.bavlna.bazalka.bazilika.bazuka.bedna.beran.beseda.bestie.beton.bezinka.bezmoc.beztak.bicykl.bidlo.biftek.bikiny.bilance.biograf.biolog.bitva.bizon.blahobyt.blatouch.blecha.bledule.blesk.blikat.blizna.blokovat.bloudit.blud.bobek.bobr.bodlina.bodnout.bohatost.bojkot.bojovat.bokorys.bolest.borec.borovice.bota.boubel.bouchat.bouda.boule.bourat.boxer.bradavka.brambora.branka.bratr.brepta.briketa.brko.brloh.bronz.broskev.brunetka.brusinka.brzda.brzy.bublina.bubnovat.buchta.buditel.budka.budova.bufet.bujarost.bukvice.buldok.bulva.bunda.bunkr.burza.butik.buvol.buzola.bydlet.bylina.bytovka.bzukot.capart.carevna.cedr.cedule.cejch.cej

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\mnemonic\wordlist\english.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):13116
                                                                                                                                                                                                                      Entropy (8bit):4.2192956006819475
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:DAvLtKog3W8jiD1/oLpsExUKqlyjn6SybkSoxIFg/7mSX30hB8OnqdE5HpF2gS2:MvLAog/I1wdsExXxigaSUvRj5r
                                                                                                                                                                                                                      MD5:F23506956964FA69C98FA3FB5C8823B5
                                                                                                                                                                                                                      SHA1:B2D5241AE027A0E40F06A33D909809A190F210FE
                                                                                                                                                                                                                      SHA-256:2F5EED53A4727B4BF8880D8F3F199EFC90E58503646D9FF8EFF3A2ED3B24DBDA
                                                                                                                                                                                                                      SHA-512:416C71BA30018EA292BB36CDC23C9329673485A8D8933266A9D9A7CC72153B8BAED3D430F52EAB4F5D3ADDF6583611B3777A50454599F1E42716F5F879621123
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:abandon.ability.able.about.above.absent.absorb.abstract.absurd.abuse.access.accident.account.accuse.achieve.acid.acoustic.acquire.across.act.action.actor.actress.actual.adapt.add.addict.address.adjust.admit.adult.advance.advice.aerobic.affair.afford.afraid.again.age.agent.agree.ahead.aim.air.airport.aisle.alarm.album.alcohol.alert.alien.all.alley.allow.almost.alone.alpha.already.also.alter.always.amateur.amazing.among.amount.amused.analyst.anchor.ancient.anger.angle.angry.animal.ankle.announce.annual.another.answer.antenna.antique.anxiety.any.apart.apology.appear.apple.approve.april.arch.arctic.area.arena.argue.arm.armed.armor.army.around.arrange.arrest.arrive.arrow.art.artefact.artist.artwork.ask.aspect.assault.asset.assist.assume.asthma.athlete.atom.attack.attend.attitude.attract.auction.audit.august.aunt.author.auto.autumn.average.avocado.avoid.awake.aware.away.awesome.awful.awkward.axis.baby.bachelor.bacon.badge.bag.balance.balcony.ball.bamboo.banana.banner.bar.barely.bargain.barre

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\mnemonic\wordlist\french.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):16777
                                                                                                                                                                                                                      Entropy (8bit):4.213242727095934
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:6J+AAri16KDuR4ckw3ezywsNB7CJEu4XjooTiOPMk8YTCm:6IAYi16muR4GezyhNB7r0HG8EP
                                                                                                                                                                                                                      MD5:F5905FD22FD0DEB0BE40F356204BA3FB
                                                                                                                                                                                                                      SHA1:BCD81ED81906BDAB57D9700A23413A7E22487D0E
                                                                                                                                                                                                                      SHA-256:EBC3959AB7801A1DF6BAC4FA7D970652F1DF76B683CD2F4003C941C63D517E59
                                                                                                                                                                                                                      SHA-512:001B2E7D1D17416776FA5306E4F7EC5812F3F35CC26FDE46800A7DAB1412870AC8B779B0C2FEC1D75C24B80868E55BC5BFB88C8DED50C84040248B76A2C5332D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:abaisser.abandon.abdiquer.abeille.abolir.aborder.aboutir.aboyer.abrasif.abreuver.abriter.abroger.abrupt.absence.absolu.absurde.abusif.abyssal.acade.mie.acajou.acarien.accabler.accepter.acclamer.accolade.accroche.accuser.acerbe.achat.acheter.aciduler.acier.acompte.acque.rir.acronyme.acteur.actif.actuel.adepte.ade.quat.adhe.sif.adjectif.adjuger.admettre.admirer.adopter.adorer.adoucir.adresse.adroit.adulte.adverbe.ae.rer.ae.ronef.affaire.affecter.affiche.affreux.affubler.agacer.agencer.agile.agiter.agrafer.agre.able.agrume.aider.aiguille.ailier.aimable.aisance.ajouter.ajuster.alarmer.alchimie.alerte.alge.bre.algue.alie.ner.aliment.alle.ger.alliage.allouer.allumer.alourdir.alpaga.altesse.alve.ole.amateur.ambigu.ambre.ame.nager.amertume.amidon.amiral.amorcer.amour.amovible.amphibie.ampleur.amusant.analyse.anaphore.anarchie.anatomie.ancien.ane.antir.angle.angoisse.anguleux.animal.annexer.annonce.annuel.anodin.anomalie.anonyme.anormal.antenne.antidote.anxieux.apaiser.ape.ritif.a

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\mnemonic\wordlist\italian.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):16033
                                                                                                                                                                                                                      Entropy (8bit):4.007887655086134
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:7TRlelKQfV+XsNs6d6NN5Qd3kR72+ImtKlhT3sdHy1WVO0iiG:7TmBtP7dwN5Qpi4lG1VO0a
                                                                                                                                                                                                                      MD5:FBE635509A2859B7B6DE2C0F16F15ED8
                                                                                                                                                                                                                      SHA1:C6214EB1CEC7B1EE8CBA1F317AC612C51881448A
                                                                                                                                                                                                                      SHA-256:D392C49FDB700A24CD1FCEB237C1F65DCC128F6B34A8AACB58B59384B5C648C2
                                                                                                                                                                                                                      SHA-512:D3DCA24CF03F04EEA1872D98C91748A8AA7AEAC6E2C885A99F2D452904A75FFCF271506DB369335726C0E3F7C8A6454935782586414B9AFFD2FE0EB004223DA1
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:abaco.abbaglio.abbinato.abete.abisso.abolire.abrasivo.abrogato.accadere.accenno.accusato.acetone.achille.acido.acqua.acre.acrilico.acrobata.acuto.adagio.addebito.addome.adeguato.aderire.adipe.adottare.adulare.affabile.affetto.affisso.affranto.aforisma.afoso.africano.agave.agente.agevole.aggancio.agire.agitare.agonismo.agricolo.agrumeto.aguzzo.alabarda.alato.albatro.alberato.albo.albume.alce.alcolico.alettone.alfa.algebra.aliante.alibi.alimento.allagato.allegro.allievo.allodola.allusivo.almeno.alogeno.alpaca.alpestre.altalena.alterno.alticcio.altrove.alunno.alveolo.alzare.amalgama.amanita.amarena.ambito.ambrato.ameba.america.ametista.amico.ammasso.ammenda.ammirare.ammonito.amore.ampio.ampliare.amuleto.anacardo.anagrafe.analista.anarchia.anatra.anca.ancella.ancora.andare.andrea.anello.angelo.angolare.angusto.anima.annegare.annidato.anno.annuncio.anonimo.anticipo.anzi.apatico.apertura.apode.apparire.appetito.appoggio.approdo.appunto.aprile.arabica.arachide.aragosta.araldica.arancio.aratur

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\mnemonic\wordlist\japanese.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):26423
                                                                                                                                                                                                                      Entropy (8bit):3.554983747162495
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:OwUkxkf27FkrH9tW/JgODfFFuHgFFqfw8QCBdqLMCl:Ogxkf27FkrdtW/JgOD9FuHgFFqfwLidW
                                                                                                                                                                                                                      MD5:C71FCA9FD3FE9F85514CB38A58859DE2
                                                                                                                                                                                                                      SHA1:A4EC1DA6C11A8C251195C7AD90817DDA6FE64488
                                                                                                                                                                                                                      SHA-256:2EED0AEF492291E061633D7AD8117F1A2B03EB80A29D0E4E3117AC2528D05FFD
                                                                                                                                                                                                                      SHA-512:3FAF87F7E48EB6635F7D7B18A34E7DACBC2C43A1CF6AA9C96015B2A3549710B8B7A0961E5D2E32D7E369099DB89A874C4D761A8384FB558744C7F47CA8CB0772
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\mnemonic\wordlist\korean.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):37832
                                                                                                                                                                                                                      Entropy (8bit):3.7380887691649907
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:m57ktAhYlpH/gN8G3Ufyy7+Lp5vx5fBECMLJbnSTyKeeHjbnHeRigUuVyS+sOpVl:MSWhGES2O/r6
                                                                                                                                                                                                                      MD5:EC271D4926B82EF5C02AEFA7DD2DAAF4
                                                                                                                                                                                                                      SHA1:6C5C5F38E75673D1CEA20F2700468ADC163D869B
                                                                                                                                                                                                                      SHA-256:9E95F86C167DE88F450F0AAF89E87F6624A57F973C67B516E338E8E8B8897F60
                                                                                                                                                                                                                      SHA-512:E645A1E0F26F2727A8FB7605D3B59668A670C9DF04D07576FE473D844A23D0192020AEDC286FBB9B1F64709AD30E6ACB825803CF9F872954C1324AEFD4977710
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:..................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\mnemonic\wordlist\portuguese.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):15671
                                                                                                                                                                                                                      Entropy (8bit):4.053540036444415
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:XM3AG0Qk5DN0Wf3MmmzpjbdU5nTEHkYk0h3Vcf+VDG:c3AQMJ0Wf3HWby5QHkY9Vcf+tG
                                                                                                                                                                                                                      MD5:05EE6FDE129776830351BBACD5B0DCFB
                                                                                                                                                                                                                      SHA1:472727867B394A1C9168690C415B0094DC3A3383
                                                                                                                                                                                                                      SHA-256:2685E9C194C82AE67E10BA59D9EA5345A23DC093E92276FC5361F6667D79CD3F
                                                                                                                                                                                                                      SHA-512:0E6AA42870C6F9A77BDA0931EA9423FEBFFEFBEB49E9DBDA5FA732FC3479942629050517FEF57BB1A76026195E16785186C0CFE26261C8FCC31F52FE69BEDA0F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:abacate.abaixo.abalar.abater.abduzir.abelha.aberto.abismo.abotoar.abranger.abreviar.abrigar.abrupto.absinto.absoluto.absurdo.abutre.acabado.acalmar.acampar.acanhar.acaso.aceitar.acelerar.acenar.acervo.acessar.acetona.achatar.acidez.acima.acionado.acirrar.aclamar.aclive.acolhida.acomodar.acoplar.acordar.acumular.acusador.adaptar.adega.adentro.adepto.adequar.aderente.adesivo.adeus.adiante.aditivo.adjetivo.adjunto.admirar.adorar.adquirir.adubo.adverso.advogado.aeronave.afastar.aferir.afetivo.afinador.afivelar.aflito.afluente.afrontar.agachar.agarrar.agasalho.agenciar.agilizar.agiota.agitado.agora.agradar.agreste.agrupar.aguardar.agulha.ajoelhar.ajudar.ajustar.alameda.alarme.alastrar.alavanca.albergue.albino.alcatra.aldeia.alecrim.alegria.alertar.alface.alfinete.algum.alheio.aliar.alicate.alienar.alinhar.aliviar.almofada.alocar.alpiste.alterar.altitude.alucinar.alugar.aluno.alusivo.alvo.amaciar.amador.amarelo.amassar.ambas.ambiente.ameixa.amenizar.amido.amistoso.amizade.amolador.amontoar.a

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\mnemonic\wordlist\russian.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):26538
                                                                                                                                                                                                                      Entropy (8bit):3.827508989563015
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:ou+5yukI02DpvaXhg8CnLOTsPsyOB7lanqA1p6tut/Mf2:H+5SIjDpvaXhrUSTsPsBBpand7xxMf2
                                                                                                                                                                                                                      MD5:8950901A308B43D263E31A377306D987
                                                                                                                                                                                                                      SHA1:7792B55B1838FAA8928C2528D304C2044ECD87BF
                                                                                                                                                                                                                      SHA-256:07F11AF3F07FD13D8D74859F4448D8BCA8F1D9D336DC4842531ECEA083103A26
                                                                                                                                                                                                                      SHA-512:5B747B7345E23F34DAFB35AFD9C2CB66AAD51456A7ACCBD9BF9CA7C285498A74C50647DA4D553AF763505935E1519F61204DB87D998B09583CC2585C91833B6B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\mnemonic\wordlist\spanish.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):13996
                                                                                                                                                                                                                      Entropy (8bit):4.187487403267613
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:7SvbJ9E182qrUD0py4gnW6ji3Jl3ggHQqy8:s9ET1DsyXnne3xX
                                                                                                                                                                                                                      MD5:5171EE312F7709BEC7660BC9AC07351A
                                                                                                                                                                                                                      SHA1:B99205D24970E0ADA8E2182A1A68F1EB439C95A1
                                                                                                                                                                                                                      SHA-256:46846A5A0139D1E3CB77293E521C2865F7BCDB82C44E8D0A06A2CD0ECBA48C0B
                                                                                                                                                                                                                      SHA-512:0E838229265DE6C80505088682D2DC9510147C3AB1713B556B594D09529B493CC3A7E391AD690DDA2052D4E11C56572F8A215A7FFFDB2630B13B4637329F3C31
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:a.baco.abdomen.abeja.abierto.abogado.abono.aborto.abrazo.abrir.abuelo.abuso.acabar.academia.acceso.accio.n.aceite.acelga.acento.aceptar.a.cido.aclarar.acne..acoger.acoso.activo.acto.actriz.actuar.acudir.acuerdo.acusar.adicto.admitir.adoptar.adorno.aduana.adulto.ae.reo.afectar.aficio.n.afinar.afirmar.a.gil.agitar.agoni.a.agosto.agotar.agregar.agrio.agua.agudo.a.guila.aguja.ahogo.ahorro.aire.aislar.ajedrez.ajeno.ajuste.alacra.n.alambre.alarma.alba.a.lbum.alcalde.aldea.alegre.alejar.alerta.aleta.alfiler.alga.algodo.n.aliado.aliento.alivio.alma.almeja.almi.bar.altar.alteza.altivo.alto.altura.alumno.alzar.amable.amante.amapola.amargo.amasar.a.mbar.a.mbito.ameno.amigo.amistad.amor.amparo.amplio.ancho.anciano.ancla.andar.ande.n.anemia.a.ngulo.anillo.a.nimo.ani.s.anotar.antena.antiguo.antojo.anual.anular.anuncio.an.adir.an.ejo.an.o.apagar.aparato.apetito.apio.aplicar.apodo.aporte.apoyo.aprender.aprobar.apuesta.apuro.arado.aran.a.arar.a.rbitro.a.rbol.arbusto.archivo.arc

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\mnemonic\wordlist\turkish.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):15324
                                                                                                                                                                                                                      Entropy (8bit):4.562888468144625
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:RyHE73AnXs3FzmzZIPXJBmqM0yHvnWMGRUIHF3N09GU:RWE7QnX6PPX7M0yPnvGHl3N0GU
                                                                                                                                                                                                                      MD5:BA9ADCC5210C101DF4B26871504F253D
                                                                                                                                                                                                                      SHA1:C0AEDCD8297FB58456C0A60854E04B547DFC9576
                                                                                                                                                                                                                      SHA-256:A7DC9C77913726106C7B8BAA022B7E17601D118ACF40AA60AB1FBC9C91B383AC
                                                                                                                                                                                                                      SHA-512:D16BADD39006E06FC5AD03AA7AA622ED19A19271E300061183BFA7A2F913919E8A0C831BC74FA3E6DEE1EC35AF01AC904D2617EC3EF7DFA3FADE6EBEF788E218
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:abajur.abak.s.abart..abdal.abdest.abiye.abluka.abone.absorbe.abs.rt.acayip.acele.acemi.a..kg.z.adalet.adam.adezyon.adisyon.adliye.adres.afacan.afili.afi..afiyet.aforizm.afra.a.a..a..r.ahbap.ahkam.ahlak.ahtapot.aidat.aile.ajan.akademi.akarsu.akba..akci.er.akdeniz.ak.bet.ak.l.ak.nt..akide.akrep.akrobasi.aksiyon.ak.am.aktif.akt.r.aktris.akustik.alaca.alb.m.al.ak.aldanma.aleni.alet.alfabe.alg.lama.al.ngan.alk...alkol.alpay.alperen.alt.n.alt.st.altyap..alyuvar.amade.amat.r.amazon.ambalaj.amblem.ambulans.amca.amel.amigo.amir.amiyane.amorti.ampul.anadolu.anahtar.anakonda.anaokul.anapara.anar.i.anatomi.anayasa.anekdot.anestezi.angaje.anka.anket.anlaml..anne.anomali.anonim.anten.antla.ma.apse.araba.arac..araf.arbede.arda.arefe.arena.argo.arg.man.arkada..armoni.aroma.arsa.ars.z.art..artist.aruz.asans.r.asayi..asfalt.asgari.asil.asker.ask..aslan.asosyal.astsubay.asya.a....a..r..a.ure.atabey.ataman.ate..atmaca.atmosfer.atom.at.lye.avc..avdet.avize.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\pyexpat.pyd

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):170264
                                                                                                                                                                                                                      Entropy (8bit):6.693484567356425
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:M5QtHVOqzYcylPwZzS8JqTuo0BmSWjIuVBY/xux08YvVILLh8ptCuX5x+:M2tHjzYcyu+unESWXA/xaYvD0
                                                                                                                                                                                                                      MD5:92C72753FA5C8EAA615B007F89CDB482
                                                                                                                                                                                                                      SHA1:34238E31E0D963838FF551B184EAB3267767AD12
                                                                                                                                                                                                                      SHA-256:EBBDE07AFB2BB356CD400E97D8AFB5ABBC121CC0CC90F99BEC9C3FA5CA60DE14
                                                                                                                                                                                                                      SHA-512:A80BBA7095E7178591266E411414B3A6A2CBA09B79F330631AC07A72C6EB2AFD1C50D7346938ED337A911307B15660C17D14FACC7AFC6EFD9759BFBEC2121BD6
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......i^C.-?-.-?-.-?-.$G..#?-..J,./?-..J(.!?-..J).'?-..J../?-..J,./?-.fG,..?-.-?,._?-..J%.)?-..J-.,?-..J..,?-..J/.,?-.Rich-?-.........PE..L...M.,d...........!......................................................................@..........................:..P...`:.......p...............j.../......( ...5..T............................5..@............................................text............................... ..`.rdata...U.......V..................@..@.data........P.......2..............@....rsrc........p.......>..............@..@.reloc..( ......."...H..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\python3.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):65816
                                                                                                                                                                                                                      Entropy (8bit):6.185813124894273
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:rU8LeBLeeFtp5V1BfO2yvSk70QZF1nEyjnskQkr/RFB1qucwdBeCw0myou6ZwJqv:rUwewnvtjnsfwIVILL0s7SytPxS
                                                                                                                                                                                                                      MD5:CD87B0D055B7ECE0C469A2562EDE9DD3
                                                                                                                                                                                                                      SHA1:0EC9300BC910D5CECE38869AAD4FF8A28F10A09B
                                                                                                                                                                                                                      SHA-256:260B946068120C33460F0992C01AD413B6D464A056CB0D1F83C39FCBCC2FCBAB
                                                                                                                                                                                                                      SHA-512:290D4DFFA1E4A897BF12A971CEF59149749BB980F2DB3DBD0C907FC6C6544456A9C58D89A5BCDDB8151BC5260A268646A95FBCFE5A5C3AD69F94B271A3B622E4
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........A.d.A.d.A.d...l.@.d...d.@.d.....@.d...f.@.d.RichA.d.PE..L...!.,d...........!......................................................................@.........................`...`................................/..............T............................................................................rdata..............................@..@.rsrc...............................@..@....!.,d........7...............!.,d........................!.,d........|...$...$...........................D1......F...F............*..^1...1...1...1...2..B2..x2...2...2..&3..L3..w3...3...3...4..P4...4...4...4...5..=5..p5...5...5...6..56..f6...6...6...6../7..S7..w7...7...7...8..<8..j8...8...8...8...9..<9..g9...9...9...:..3:..c:...:...:...:...;..R;...;...;...;..#<..[<...<...<...<...=..?=...=...=...=..&>..[>...>...>...>..+?.._?...?...?...@..E@..}@...@...@...A..>A..lA...A...A...A..+B..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\python310.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4143384
                                                                                                                                                                                                                      Entropy (8bit):6.719606889163802
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:49152:0izdDWQcAdLh1ckY/wqIEh8rvZGsIBGfHP2MZnaPxQ1w7OEnGI8wgJyf:0uAk3rWBcH+MZ0Q1wlnYZJY
                                                                                                                                                                                                                      MD5:73CADAB187AD5E06BEF954190478E3AA
                                                                                                                                                                                                                      SHA1:18AB7B6FE86193DF108A5A09E504230892DE453E
                                                                                                                                                                                                                      SHA-256:B4893ED4890874D0466FCA49960D765DD4C2D3948A47D69584F5CC51BBBFA4C9
                                                                                                                                                                                                                      SHA-512:B2EBE575F3252FF7ABEBAB23FC0572FC8586E80D902D5A731FB7BD030FAA47D124240012E92FFE41A841FA2A65C7FB110AF7FB9AB6E430395A80E925283E2D4D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d...............p.......jf......p.......p.......p.......}.......}...............p.......p.......pd......p......Rich............PE..L.....,d...........!......$...........$.......$...............................B......3@...@..........................%:.......:.|.....?...............?../....?.l1..(.9.T.............................9.@.............$..............................text.....$.......$................. ..`.rdata...F....$..H....$.............@..@.data.........;.......:.............@...PyRuntimh.....?.......<.............@....rsrc.........?.......<.............@..@.reloc..l1....?..2....<.............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_bcash_tx_502e8577b237b0152843a416f8f1ab0c63321b1be7a8cad7bf5c5c216fcf062c.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1885
                                                                                                                                                                                                                      Entropy (8bit):5.255142499174794
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:YVNA5wP62ZawdeqFWNA5K2ZWEEnSFjrDEfewL1ln5bqAvpHBdgSGCWYEH8XSk5Ea:Yni2Iwdo2o2rrA/qABHBdg81SyxHSJo
                                                                                                                                                                                                                      MD5:D11BCE86BBB84EEDB70042A410931BB3
                                                                                                                                                                                                                      SHA1:C5B0F891BD08421920B17B89F1777FAEB629D28B
                                                                                                                                                                                                                      SHA-256:8CFB4D1D0C5C4CF36E231D9955DD38F460E33D5CC219AFFF48B422D980504BC2
                                                                                                                                                                                                                      SHA-512:072ADA09F6DC9ED39E9849B7059BACD54A8993C2295A3AA3E570E72D3502082A773A32D49FBC52AC81DD1D2483D30D0D58CF38998AC45129BECE3D11D7D4188F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"vout": [{"scriptPubKey": {"type": "pubkeyhash", "asm": "OP_DUP OP_HASH160 b1401fce7e8bf123c88a0467e0ed11e3b9fbef54 OP_EQUALVERIFY OP_CHECKSIG", "addresses": ["1HADRPJpgqBzThepERpVXNi6qRgiLQRNoE"], "hex": "76a914b1401fce7e8bf123c88a0467e0ed11e3b9fbef5488ac"}, "n": 0, "spentHeight": 478743, "value": "0.01896050", "spentTxId": "5594fd9e5e26dcb4437cbbbba517401720849159bac4e2158e1e6401ffd5fdb7", "spentIndex": 0}, {"scriptPubKey": {"type": "pubkeyhash", "asm": "OP_DUP OP_HASH160 d51eca49695cdf47e7f4b55507893e3ad53fe9d8 OP_EQUALVERIFY OP_CHECKSIG", "addresses": ["1LRspCZNFJcbuNKQkXgHMDucctFRQya5a3"], "hex": "76a914d51eca49695cdf47e7f4b55507893e3ad53fe9d888ac"}, "n": 1, "spentHeight": 478743, "value": "0.00073452", "spentTxId": "5594fd9e5e26dcb4437cbbbba517401720849159bac4e2158e1e6401ffd5fdb7", "spentIndex": 1}], "fees": 0.00025842, "size": 225, "confirmations": 383, "blockheight": 478743, "txid": "502e8577b237b0152843a416f8f1ab0c63321b1be7a8cad7bf5c5c216fcf062c", "blockhash": "0000000000000

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_bcash_tx_8b6db9b8ba24235d86b053ea2ccb484fc32b96f89c3c39f98d86f90db16076a0.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2028
                                                                                                                                                                                                                      Entropy (8bit):4.96188924342764
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:YV7UzUiK2FocJxxw8O3VcRfnXqqhxZkCWOMS2Q0NCIZm0xttyR2QrIZmRttyG1nn:Y9UpKgxgMvq4sRttyL0qttyu
                                                                                                                                                                                                                      MD5:E17D0CCA6B9442822B1DB16937DB0DE7
                                                                                                                                                                                                                      SHA1:BC4DDD686E0270894F882DCCE0064F7684B2F373
                                                                                                                                                                                                                      SHA-256:CFC6E06077329625E665010F1DEFBFFAEC067C530590F5643C8D82AD385E4EF9
                                                                                                                                                                                                                      SHA-512:F6C9FAE92AF950E459E519A7D9AEDD17168914FE4AD178872D7645DF286710967E14B3B660A8C8DB45F8C91706C6074C4586D9229A8AA833185E397ABD442DF4
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"vout": [{"scriptPubKey": {"type": "scripthash", "asm": "OP_HASH160 11c1566006ab2b8e8c8d981055b090ecdefa9771 OP_EQUAL", "addresses": ["33Ju286QvonBz5N1V754ZekQv4GLJqcc5R"], "hex": "a91411c1566006ab2b8e8c8d981055b090ecdefa977187"}, "n": 0, "spentHeight": -1, "value": "0.00048490", "spentTxId": "f68caf10df12d5b07a34601d88fa6856c6edcbf4d05ebef3486510ae1c293d5f", "spentIndex": 0}], "fees": 1.51e-05, "size": 338, "confirmations": 5, "blockheight": 479121, "txid": "8b6db9b8ba24235d86b053ea2ccb484fc32b96f89c3c39f98d86f90db16076a0", "blockhash": "000000000000000004d736cdc6be7912951849d6a96e8118a5009373d51aa422", "blocktime": 1502563143, "valueOut": 0.0004849, "vin": [{"vout": 0, "n": 0, "valueSat": 50000, "doubleSpentTxID": null, "addr": "3LJVbFT3mKw46FMwQuDvUt5xFQBFsLkknn", "value": 0.0005, "sequence": 4294967294, "txid": "5f72ec264d961dfdd460a9cc22743c795127b129d40be8087244d93b3f7eee11", "scriptSig": {"asm": "0 3045022100e87e3ae6ac22ccbaa8a5800b2bbd81aad9ff56e0fc6993953635fd9ee85e49f1022049

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_bcash_tx_bc37c28dfb467d2ecb50261387bf752a3977d7e5337915071bb4151e6b711a78.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1472
                                                                                                                                                                                                                      Entropy (8bit):5.16997579741517
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:YVNA5XaT2ZoS9COfeZF4yhl1BdgSPOnCUtJCrpDjlCWTmUtSj4qmUtSwk1neY:YJT2C7UinBdggXwJTgSIgSF
                                                                                                                                                                                                                      MD5:F5F7FE7C16A3462A48D4443489B36CF5
                                                                                                                                                                                                                      SHA1:7B641C5C80FE555E227027B405843CAAAA465ED6
                                                                                                                                                                                                                      SHA-256:3F4E12FDAC7E408F5BDAF52EEA53B0751D3C3A534CD9E6C0D3246F1F05433FAD
                                                                                                                                                                                                                      SHA-512:87A93F35C12216270D2E2772C5F5F9DD04E65E2F8C9C66FEFC605EA766FA2BDB18D954F46809AE2ABEAD119A6653CC7CCEA11C10EBD4D9012BF3CCCE2DACD01B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"vout": [{"scriptPubKey": {"type": "pubkeyhash", "asm": "OP_DUP OP_HASH160 de701ce12e576395c863e9377c76dd7efe0c55c1 OP_EQUALVERIFY OP_CHECKSIG", "addresses": ["1MH9KKcvdCTY44xVDC2k3fjBbX5Cz29N1q"], "hex": "76a914de701ce12e576395c863e9377c76dd7efe0c55c188ac"}, "n": 0, "spentHeight": 478743, "value": "0.01995344", "spentTxId": "502e8577b237b0152843a416f8f1ab0c63321b1be7a8cad7bf5c5c216fcf062c", "spentIndex": 0}], "fees": 4.656e-05, "size": 192, "confirmations": 503, "blockheight": 478623, "txid": "bc37c28dfb467d2ecb50261387bf752a3977d7e5337915071bb4151e6b711a78", "blockhash": "000000000000000004cc670aab354e9593d789ec091d571f99fb4ad67ec865a2", "blocktime": 1501857558, "valueOut": 0.01995344, "vin": [{"vout": 1, "n": 0, "valueSat": 2000000, "doubleSpentTxID": null, "addr": "1DS6LVgFWZBGVin3y5B9emUxHtnuQetp9L", "value": 0.02, "sequence": 4294967295, "txid": "8d566ad80d5f1d3887d3acddb35b980641919e6efa7c3a3a78413e56f95ea516", "scriptSig": {"asm": "3045022100860b4c43649f86ee603c13791646af4736c

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_bcash_tx_f68caf10df12d5b07a34601d88fa6856c6edcbf4d05ebef3486510ae1c293d5f.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2268
                                                                                                                                                                                                                      Entropy (8bit):5.109000243989634
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:YWLiqKmDdO1C2WHcgcHUZrVG1ZK+uZBe5rVG1ZK+uV6eP:fWwE1C2WHcHHqrVYvH5rVYvheP
                                                                                                                                                                                                                      MD5:F7D8526E29FABE3A1285D411AB8896E0
                                                                                                                                                                                                                      SHA1:CB7AF6389EFA5B8EDDA90CE46FDFCF4C42DE4C43
                                                                                                                                                                                                                      SHA-256:4931DF379CF798B2CDA0AEF40808636E68CF15EAA0D5BF529D9D6C900C65A435
                                                                                                                                                                                                                      SHA-512:6C3E2E26E198A0AF4C026FCA0875AF9236F5A37B35914550AB65F17D26EB9011F4397C97533D15CDE1B3EBE5017EB1D26A20792ECA42AA01C37FA5A072C95853
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"version": 1, "fees": 4.9e-06, "valueIn": 0.0004849, "valueOut": 0.00048, "locktime": 0, "txid": "f68caf10df12d5b07a34601d88fa6856c6edcbf4d05ebef3486510ae1c293d5f", "size": 373, "time": 1502564873, "confirmations": 0, "blockheight": -1, "vout": [{"spentIndex": null, "n": 0, "spentHeight": null, "value": "0.00024000", "scriptPubKey": {"hex": "76a91400741952f6a6eab5394f366db5cc5a54b0c2429f88ac", "type": "pubkeyhash", "asm": "OP_DUP OP_HASH160 00741952f6a6eab5394f366db5cc5a54b0c2429f OP_EQUALVERIFY OP_CHECKSIG", "addresses": ["113Q5hHQNQ3bc1RpPX6UNw4GAXstyeA3Dk"]}, "spentTxId": null}, {"spentIndex": 0, "n": 1, "spentHeight": -1, "value": "0.00024000", "scriptPubKey": {"hex": "a914756c06d7e77de3950a6124f026d8e1a2464b3ecf87", "type": "scripthash", "asm": "OP_HASH160 756c06d7e77de3950a6124f026d8e1a2464b3ecf OP_EQUAL", "addresses": ["3CPtPpL5mGAPdxUeUDfm2RNdWoSN9dKpXE"]}, "spentTxId": "db845018e2049b0d81fca81cfec585cde9a50bae81ae095d53ee86ffd5f8c99b"}], "vin": [{"sequence": 4294967295, "valu

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_bitcoin_gold_tx_25526bf06c76ad3082bba930cf627cdd5f1b3cd0b9907dd7ff1a07e14addc985.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1138
                                                                                                                                                                                                                      Entropy (8bit):5.266045788316132
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:Y7MlpeZgEVv3P9FhRnelR5sel22Zrh9qIxwgqvKIZcN8ZJxInenRw:Yg0v3pBemeA2ljRxwFvxl7w
                                                                                                                                                                                                                      MD5:C0A65537E2D1226B9ADE8277BBBA3E20
                                                                                                                                                                                                                      SHA1:F398CBD84987A4B813709D10B165A32307332007
                                                                                                                                                                                                                      SHA-256:6959BAC4284CB9B4F6D14EDA6EFCC8D9E9FB623FEB689B5AAAD6DAEFDADA73BD
                                                                                                                                                                                                                      SHA-512:A503F6063E545A0412AC6BFD4988DAB2C66AEA9551414D1467DF0101F612880FC76F6CE2EEC4322CDA121B70133A16254A9D24FA3C94E4025C18F59158DA208D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"txid": "25526bf06c76ad3082bba930cf627cdd5f1b3cd0b9907dd7ff1a07e14addc985", "version": 1, "locktime": 0, "vin": [{"coinbase": "03b4e407005a2d4e4f4d50212068747470733a2f2f6769746875622e636f6d2f6a6f7368756179616275742f7a2d6e6f6d70", "sequence": 4294967295, "n": 0}], "vout": [{"value": "12.52382934", "n": 0, "scriptPubKey": {"hex": "76a9140cb60a52559620e5de9a297612d49f55f7fd14ea88ac", "asm": "OP_DUP OP_HASH160 0cb60a52559620e5de9a297612d49f55f7fd14ea OP_EQUALVERIFY OP_CHECKSIG", "addresses": ["GK18bp4UzC6wqYKKNLkaJ3hzQazTc3TWBw"], "type": "pubkeyhash"}, "spentTxId": null, "spentIndex": null, "spentHeight": null}, {"value": "0.00000000", "n": 1, "scriptPubKey": {"hex": "6a24aa21a9eddb3ac2bba12721c8db157ba6b522196093d3a27a8083591a2b785a230a1d254f", "asm": "OP_RETURN aa21a9eddb3ac2bba12721c8db157ba6b522196093d3a27a8083591a2b785a230a1d254f"}, "spentTxId": null, "spentIndex": null, "spentHeight": null}], "blockhash": "000000000b9f4d15e03603463f536b7b9da695580ae8b8bcdac5970195b586f4", "blockhei

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_bitcoin_gold_tx_db77c2461b840e6edbe7f9280043184a98e020d9795c1b65cb7cef2551a8fb18.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2134
                                                                                                                                                                                                                      Entropy (8bit):5.112227801446302
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:YEfJPPJzJW8eBO9TjfNTjjJW8cvr12WRl3Kn:rBZVPeB8TjlTjlPcJ2WRon
                                                                                                                                                                                                                      MD5:26ECF15DAFE18BA40D5F79C05399C31D
                                                                                                                                                                                                                      SHA1:3A89B6CCD0B8CBC6ACF1E39B1E572C4AF1D6B94B
                                                                                                                                                                                                                      SHA-256:F0E729A973CCBF572F0690FF0FC51498C319C7C86CF4F19C37FE18D06CF560DB
                                                                                                                                                                                                                      SHA-512:D385AF66E4B26458279F58F873D813F79B7A54FE7E73DD59DC45C6074BA17B0D3D4EA6F479081A4C7C114C3A4E78361A83CD284E174A06FF6CC73CCBF95598FA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"txid": "db77c2461b840e6edbe7f9280043184a98e020d9795c1b65cb7cef2551a8fb18", "version": 1, "locktime": 0, "vin": [{"txid": "52fb172f86926a89a16edf55bc9baec3929149b7cd2d2389be3c7d08d744d300", "vout": 1, "sequence": 4294967295, "n": 0, "scriptSig": {"hex": "4830450221008bff524a092086372a19b924f41fa7fa2a5523bf42a4801b9503fcdfff2094e8022000f223a032bd0d7fee31d5663cd5cf86b82533bda6871366d519a68deae1042341210222c6760cc54de6fd7f2a40207a13137d497c7cdb472376523700d8ea88275a96", "asm": "30450221008bff524a092086372a19b924f41fa7fa2a5523bf42a4801b9503fcdfff2094e8022000f223a032bd0d7fee31d5663cd5cf86b82533bda6871366d519a68deae10423[ALL|FORKID] 0222c6760cc54de6fd7f2a40207a13137d497c7cdb472376523700d8ea88275a96"}, "addr": "GgdFx96JSR3nbyhtgxqsUessZLarxLWA3J", "valueSat": 2128176, "value": "0.02128176", "doubleSpentTxID": null}, {"txid": "371eb4feaa4085b378bb825f3c1b457867c24211ee838584b1adac226bba654b", "vout": 0, "sequence": 4294967295, "n": 1, "scriptSig": {"hex": "47304402206aee1d853479782029755dd3c3

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_bitcoin_tx_1570416eb4302cf52979afd5e6909e37d8fdd874301f7cc87e547e509cb1caa6.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1743
                                                                                                                                                                                                                      Entropy (8bit):5.31554870261559
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:YNVCdNww5F2ZNCdNE22u5k+2ZBCxBnlLsCxS7GpT8NyqzGpTvNy5uy0ClrUuf:YNVCwG2HCv72INsCQ6+ym6hy5uydrn
                                                                                                                                                                                                                      MD5:376238DF160736D6ED70A5F768F63926
                                                                                                                                                                                                                      SHA1:E75982C04D34105307A50954F2252E4D297AC08B
                                                                                                                                                                                                                      SHA-256:D6169B5B04EE8CB9E33AFE7785793156CC79E902986C1170AD806322CD1DF4B1
                                                                                                                                                                                                                      SHA-512:7C9DCD64E263FFA57DF818F026F231E2F69783FE182E3907CB05B355FD8DB23B85FA1BA2DAB9E6EEADA536DBBEC291447C4803EF49861F43BBC936E729AC93E2
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"valueOut": 2.2016, "vout": [{"spentIndex": null, "spentHeight": null, "value": "1.00000000", "n": 0, "spentTxId": null, "scriptPubKey": {"type": "pubkeyhash", "hex": "76a914b5089282a2e18305dbb01ee5e6c40b81993c96be88ac", "addresses": ["1HWDaLTpTCTtRWyWqZkzWx1wex5NKyncLW"], "asm": "OP_DUP OP_HASH160 b5089282a2e18305dbb01ee5e6c40b81993c96be OP_EQUALVERIFY OP_CHECKSIG"}}, {"spentIndex": null, "spentHeight": null, "value": "1.20160000", "n": 1, "spentTxId": null, "scriptPubKey": {"type": "pubkeyhash", "hex": "76a914d00f6606ddd5bfa271dd96848b9a682455af711e88ac", "addresses": ["1Ky7zozX19ULmzCLK7CGhX2BFj2moyUp5c"], "asm": "OP_DUP OP_HASH160 d00f6606ddd5bfa271dd96848b9a682455af711e OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "0000000000000000015e982463c967e1419784ef9da717344068bf7faaf9ab55", "valueIn": 2.2026, "fees": 0.001, "vin": [{"addr": "12vp7HFNua4VSjpswBhCfJJVhvqs8gkrUR", "vout": 1, "sequence": 4294967295, "doubleSpentTxID": null, "value": 2.2026, "n": 0, "valueSat": 220260000, "txid

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_bitcoin_tx_39a29e954977662ab3879c66fb251ef753e0912223a83d1dcb009111d28265e5.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2013
                                                                                                                                                                                                                      Entropy (8bit):5.210033940318343
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:Ym4E2J2RphYrJ2yaNpXllb8gwgQ/OVfgQKOVo6:WjJ2RpUJ2nNpXD9wgQufgQrv
                                                                                                                                                                                                                      MD5:EF02F292588E0B6DA2A5C0CA59E7FBC1
                                                                                                                                                                                                                      SHA1:6DC83D80B8072F89268F6BC9B6CCA86F8102EF1F
                                                                                                                                                                                                                      SHA-256:999705A47A02503E121CB010E10801699B871E920C395D34ED2B5DD265001D4C
                                                                                                                                                                                                                      SHA-512:7C21524C8ED47289BBD9581AA09DF15B566A3C3391F655A335E07964B1BC9582DAC97DA9B126673AAB1569992FE0800F8619F641A4525B7D533EC83F4D2E7A7A
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"valueOut": 3.00986058, "vout": [{"spentIndex": 30, "spentHeight": 288729, "value": "2.98446058", "n": 0, "spentTxId": "6839c71b7d192a698b5388e9ea921805279cbc9f85bae1019d2f4fe7b326979a", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a9149ef561f8f6fe602cba796137f2d56d7e8a0a4c8488ac", "addresses": ["1FVVioK1iE9X6cBZtarVj6e5vjMATc8izW"], "asm": "OP_DUP OP_HASH160 9ef561f8f6fe602cba796137f2d56d7e8a0a4c84 OP_EQUALVERIFY OP_CHECKSIG"}}, {"spentIndex": 1, "spentHeight": 284875, "value": "0.02540000", "n": 1, "spentTxId": "4a7b7e0403ae5607e473949cfa03f09f2cd8b0f404bf99ce10b7303d86280bf7", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a914812c13d97f9159e54e326b481b8f88a73df8507a88ac", "addresses": ["1CmzyJp9w3NafXMSEFH4SLYUPAVCSUrrJ5"], "asm": "OP_DUP OP_HASH160 812c13d97f9159e54e326b481b8f88a73df8507a OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "00000000000000016732dadfc971c98b308d46283f0340c0ad9479fc65a28550", "valueIn": 3.00996058, "fees": 0.0001, "vin": [{"addr": "1M2Qq4P8bjXrbvEYic

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_bitcoin_tx_4a7b7e0403ae5607e473949cfa03f09f2cd8b0f404bf99ce10b7303d86280bf7.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):42348
                                                                                                                                                                                                                      Entropy (8bit):5.371395930873508
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:WPxPzPZP/P5PDPxPHPBP4PdPlP5PJP9PlPBPhPdPiPXP7P7PfPXPDPzPPP3P6PJX:N2m
                                                                                                                                                                                                                      MD5:3F2818F8A6A0DF3D37B765C2A4F1ED32
                                                                                                                                                                                                                      SHA1:ACDA62BE0EF474C8C905E2BA74264C3B21822168
                                                                                                                                                                                                                      SHA-256:87E4526FFA0D2D07D678AD789533C42BB352B2ADB046BA534776E57D18B86EFD
                                                                                                                                                                                                                      SHA-512:ED64C3116AC6FA7F6C1907F97ACA895A167298021B46607337DB1A0CDB99CA8BC540D41AE3613B1F590A9C002524E874FE2D1CE3013F163E2EE63633011212C5
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"txid": "4a7b7e0403ae5607e473949cfa03f09f2cd8b0f404bf99ce10b7303d86280bf7", "version": 1, "locktime": 0, "vin": [{"txid": "c63e24ed820c5851b60c54613fbc4bcb37df6cd49b4c96143e99580a472f79fb", "vout": 1, "sequence": 4294967295, "n": 0, "scriptSig": {"hex": "493046022100b0377607841d5c6ccac13193cb1e4ebd6ee2e5d64ea94701a96c27a79d2b965d022100b9cf65e0007fd0a96db67173cc331c8fd4bef9b6d644a2ae4cb9f7df74c2a265012103477b9f0f34ae85434ce795f0c5e1e90c9420e5b5fad084d7cce9a487b94a7902", "asm": "3046022100b0377607841d5c6ccac13193cb1e4ebd6ee2e5d64ea94701a96c27a79d2b965d022100b9cf65e0007fd0a96db67173cc331c8fd4bef9b6d644a2ae4cb9f7df74c2a265[ALL] 03477b9f0f34ae85434ce795f0c5e1e90c9420e5b5fad084d7cce9a487b94a7902"}, "addr": "1CmzyJp9w3NafXMSEFH4SLYUPAVCSUrrJ5", "valueSat": 100000, "value": "0.001", "doubleSpentTxID": null}, {"txid": "39a29e954977662ab3879c66fb251ef753e0912223a83d1dcb009111d28265e5", "vout": 1, "sequence": 4294967295, "n": 1, "scriptSig": {"hex": "483045022100f908166e800b80ac2f907a90a1807a2fb

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_bitcoin_tx_50f6f1209ca92d7359564be803cb2c932cde7d370f7cee50fd1fad6790f6206d.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1878
                                                                                                                                                                                                                      Entropy (8bit):5.2309675071719175
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:YsZ2WKLBIT2nTEzjPuFEtxuF5tK9pYaaIs+w:b2LeT2wfPeAxeDK9qIs+w
                                                                                                                                                                                                                      MD5:C928D75F3BA685DCA38A932DB607D854
                                                                                                                                                                                                                      SHA1:D4E1206F78B837518065BF9D1058045AB7A425F8
                                                                                                                                                                                                                      SHA-256:5DE49B0260A492F36345937D608607C678CA59AA276405FB5ED1E675E0E2FB18
                                                                                                                                                                                                                      SHA-512:8C3870673C28F69E21CE7CE146AA6EFB5045FDC93F49A3B292A22D15718318FBC6CE31FFFB073492E0C4EAB815D2BACE2DA8D0346EC0DB588897D9BB5305B309
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"fees": 0.000113, "blocktime": 1423664307, "vout": [{"n": 0, "spentTxId": "f003c5c041d0708026e20ce97733f4561fb8c52e302692ac2e550aabe6c3912f", "value": "0.00113698", "spentHeight": 350552, "spentIndex": 0, "scriptPubKey": {"asm": "OP_DUP OP_HASH160 902c642ba3a22f5c6cfa30a1790c133ddf15cc88 OP_EQUALVERIFY OP_CHECKSIG", "hex": "76a914902c642ba3a22f5c6cfa30a1790c133ddf15cc8888ac", "addresses": ["1E9KUz71DjP3rNk2Xibd1FwyHLWfbnhrCz"], "type": "pubkeyhash"}}, {"n": 1, "spentTxId": "c275c333fd1b36bef4af316226c66a8b3693fbfcc081a5e16a2ae5fcb09e92bf", "value": "0.00050000", "spentHeight": 344045, "spentIndex": 0, "scriptPubKey": {"asm": "OP_DUP OP_HASH160 a6450f1945831a81912616691e721b787383f4ed OP_EQUALVERIFY OP_CHECKSIG", "hex": "76a914a6450f1945831a81912616691e721b787383f4ed88ac", "addresses": ["1GA9u9TfCG7SWmKCveBumdA1TZpfom6ZdJ"], "type": "pubkeyhash"}}], "vin": [{"sequence": 4294967295, "addr": "15T9DSqc6wjkPxcr2MNVSzF9JAePdvS3n1", "n": 0, "vout": 0, "scriptSig": {"asm": "304402204ec6818b86

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_bitcoin_tx_54aa5680dea781f45ebb536e53dffc526d68c0eb5c00547e323b2c32382dfba3.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2016
                                                                                                                                                                                                                      Entropy (8bit):5.193835433186479
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:YwTn1Mfa1D2pGLBDRQWLE2FhAUJgT8SLNH8xLNGPBuXX+s:J2pGLrLE2LAEgFcU/s
                                                                                                                                                                                                                      MD5:C0421A06171C4A314D7818D3247708E0
                                                                                                                                                                                                                      SHA1:CD84E267D83EB08C2E0BC46348EA6784A34DDF1A
                                                                                                                                                                                                                      SHA-256:D7054FEE1F3829EFCFAC4C3AC6D2A8607595946F0DADA3C3B51193ADE6F5A031
                                                                                                                                                                                                                      SHA-512:459A013A6263C97F0B92D1ACD7D7B1A635A972B310940D58B79DA7949E964648127DD6861202DBD0CF57B13DDEE42821BF3A0BC3D15B74E9E947B5BB28CDA273
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"valueOut": 1.05472082, "vout": [{"spentIndex": 0, "spentHeight": 293754, "value": "1.05072082", "n": 0, "spentTxId": "b664fca5b225d3fc01d6f562488136adc4d563e52fdc639db8b6f50afaa5d736", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a914486088128a2137cd53b81f3efe4c3d612b7a777f88ac", "addresses": ["17bhHwY6nhomv4RxwkEGRZ6VutKjoGMDSS"], "asm": "OP_DUP OP_HASH160 486088128a2137cd53b81f3efe4c3d612b7a777f OP_EQUALVERIFY OP_CHECKSIG"}}, {"spentIndex": 0, "spentHeight": 293786, "value": "0.00400000", "n": 1, "spentTxId": "8cc1f4adf7224ce855cf535a5104594a0004cb3b640d6714fdb00b9128832dd5", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a91424a56db43cf6f2b02e838ea493f95d8d6047423188ac", "addresses": ["14LmW5k4ssUrtbAB4255zdqv3b4w1TuX9e"], "asm": "OP_DUP OP_HASH160 24a56db43cf6f2b02e838ea493f95d8d60474231 OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "000000000000000092268fe69290d4150455aee141bfa0271c6948d18e56dfd0", "valueIn": 1.05482082, "fees": 0.0001, "vin": [{"addr": "13vPZWiYyXxX2MWZrzy

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_bitcoin_tx_58497a7757224d1ff1941488d23087071103e5bf855f4c1c44e5c8d9d82ca46e.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1998
                                                                                                                                                                                                                      Entropy (8bit):5.213712896268691
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:YR62JiN2955h62ZTRNUWvWNX5yWH2ZBGlSvnOM8VWFGSK33Ppp5zFGSK33PWpvwi:Y82xJM2uW+NHH2GlSvOMi3y3kwEKYR
                                                                                                                                                                                                                      MD5:0E420F80A7AAA938C9C95F134B485895
                                                                                                                                                                                                                      SHA1:7522B9EE7E771C0E4D5DAC73B3B07DB4A2E2FB51
                                                                                                                                                                                                                      SHA-256:B75930609237AA206CEEDA5952634B070141064A2B5FBAAB8E52B361713492F8
                                                                                                                                                                                                                      SHA-512:B7B30F0A737A722C24E1D5E5E34A69D53BF6526B0198A0AE3E16A6B24C9E91FE12FBC4112CF17CE07E067E40B024410BD3396BE0A37D03B48FE2059FA6ABE318
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"valueOut": 0.46995, "vout": [{"spentIndex": 28, "spentHeight": 288729, "value": "0.46885000", "n": 0, "spentTxId": "6839c71b7d192a698b5388e9ea921805279cbc9f85bae1019d2f4fe7b326979a", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a91459581dcaf8ed947343b569f1fa2d855d0fc6d9bf88ac", "addresses": ["199QhWMtYE79AG3547QXmZpa8NtLDgme16"], "asm": "OP_DUP OP_HASH160 59581dcaf8ed947343b569f1fa2d855d0fc6d9bf OP_EQUALVERIFY OP_CHECKSIG"}}, {"spentIndex": 1, "spentHeight": 284865, "value": "0.00110000", "n": 1, "spentTxId": "c63e24ed820c5851b60c54613fbc4bcb37df6cd49b4c96143e99580a472f79fb", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a9142db345c36563122e2fd0f5485fb7ea9bbf7cb5a288ac", "addresses": ["15AeAhtNJNKyowK8qPHwgpXkhsokzLtUpG"], "asm": "OP_DUP OP_HASH160 2db345c36563122e2fd0f5485fb7ea9bbf7cb5a2 OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "00000000000000009ea3d77854af7c8cc0f28506dc8379c89830e445d951f4bf", "valueIn": 0.47005, "fees": 0.0001, "vin": [{"addr": "19UC6mkNJyqy3iKwQQyNm4TV

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_bitcoin_tx_6189e3febb5a21cee8b725aa1ef04ffce7e609448446d3a8d6f483c634ef5315.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1854
                                                                                                                                                                                                                      Entropy (8bit):5.21621821650514
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:YXf79GCXMXK2pT1wl+yvQOlW54b/JQnirJQqilg+i:OzD2OXvQOlW8GnKGqLd
                                                                                                                                                                                                                      MD5:FD28F430B4946788FBACBC0B8050DB87
                                                                                                                                                                                                                      SHA1:1328B32D8004E8AD224B92DA62DEF56678C9D806
                                                                                                                                                                                                                      SHA-256:874B05A1E78CF372E731F8B489FD3ABC1604C52B65B188B8DB7D9643111B9DE9
                                                                                                                                                                                                                      SHA-512:29435858975967089E642D1248F392B05D098A68BA288ADF69C22AB20BA6160CB5D9FF0EFFE9D3320038909920FAEE4F5FE689F932393CCB4E6258BD98B3FA9D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"valueOut": 1.26511535, "vout": [{"spentIndex": 0, "spentHeight": 335022, "value": "1.26491535", "n": 0, "spentTxId": "79f47b5812eb8bcf13d4e60792129488ea237f86386468391d3ad3f8fdb3356e", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a91495783804d28e528fbc4b48c7700471e6845804eb88ac", "addresses": ["1EdKhXv7zjGowPzgDQ4z1wa2ukVrXRXXkP"], "asm": "OP_DUP OP_HASH160 95783804d28e528fbc4b48c7700471e6845804eb OP_EQUALVERIFY OP_CHECKSIG"}}, {"spentIndex": 0, "spentHeight": 333744, "value": "0.00020000", "n": 1, "spentTxId": "dd320786d1f58c095be0509dc56b277b6de8f2fb5517f519c6e6708414e3300b", "scriptPubKey": {"type": "scripthash", "hex": "a914fb0670971091da8248b5c900c6515727a20e866287", "addresses": ["3QaKF8zobqcqY8aS6nxCD5ZYdiRfL3RCmU"], "asm": "OP_HASH160 fb0670971091da8248b5c900c6515727a20e8662 OP_EQUAL"}}], "blockhash": "0000000000000000149287bdefeecd34a7d0770ec5954f337c508bc07f980819", "valueIn": 1.26521535, "fees": 0.0001, "vin": [{"addr": "1AZjQHKxsUFQRR24qYTBAxMsQR9bgoRL4h", "vout": 0,

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_bitcoin_tx_a6e2829d089cee47e481b1a753a53081b40738cc87e38f1d9b23ab57d9ad4396.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1787
                                                                                                                                                                                                                      Entropy (8bit):5.206869121530489
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:YfCcNQAD3mS7QAUCXBy2OhGumD9NFJ9Ns4Y3OQ:S7mSUCg2Ok9ud3b
                                                                                                                                                                                                                      MD5:2028EEFB1A798FBBF132480119395695
                                                                                                                                                                                                                      SHA1:DB4B4CE9BB82F8E40187EA40C759B7725EA4E8F6
                                                                                                                                                                                                                      SHA-256:1FDE8C1724C5E83BF591F8DD756CDFCC08776CF99B72295981AA59A769AE998B
                                                                                                                                                                                                                      SHA-512:A6635C52AC9CD0C3A4C8122B407FE442C2BB6E4D1C3B76BE95C12AD473B207002ADCF08AB96D1B184D94D89C3FBD4E3D7603E55C1BE4F8DD2A4A3B0E069BDC39
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"valueOut": 0.02262478, "vout": [{"spentIndex": null, "spentHeight": null, "value": "0.00100000", "n": 0, "spentTxId": null, "scriptPubKey": {"type": "scripthash", "hex": "a914fe5b12d8eb22356e3e071ba80dabdf7272c1898787", "addresses": ["3QsvfB6d1LzYcpm8xyhS1N1HBRrzHTgLHB"], "asm": "OP_HASH160 fe5b12d8eb22356e3e071ba80dabdf7272c18987 OP_EQUAL"}}, {"spentIndex": 0, "spentHeight": 335144, "value": "0.02162478", "n": 1, "spentTxId": "e4bc1ae5e5007a08f2b3926fe11c66612e8f73c6b00c69c7027213b84d259be3", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a914c3ddd5e35f9bbecd7b10f47b5734dbfe40e331cb88ac", "addresses": ["1JreWorDp4fm2tqPR9ntUXApyXUZPR7LSP"], "asm": "OP_DUP OP_HASH160 c3ddd5e35f9bbecd7b10f47b5734dbfe40e331cb OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "000000000000000000f2c3875e9e7998fee70fe9d3961900230fafa55201d375", "valueIn": 0.02272478, "fees": 0.0001, "vin": [{"addr": "1QFYUD8963xdqEQ1PU64t8391t148qQtbS", "vout": 1, "sequence": 4294967295, "doubleSpentTxID": null, "value": 0.0

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_bitcoin_tx_c6091adf4c0c23982a35899a6e58ae11e703eacd7954f588ed4b9cdefc4dba52.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1831
                                                                                                                                                                                                                      Entropy (8bit):5.194246236233287
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:YtB5NPJTIq8r5sJTw2ZgZU1Tjsux3ED1TT47kKO3T0xfEzMqYgkep1ePGVBFp1eb:Y7JKuJw2aClLGD67xKTifkMqYQYwYJ3p
                                                                                                                                                                                                                      MD5:60822ADFD8B26584C216E0B57D02152A
                                                                                                                                                                                                                      SHA1:1D91ECCFD1994C0F29A32EB880B347029F0B2F6E
                                                                                                                                                                                                                      SHA-256:38DADFD3BEDA94B678DDE0C93A1B56606C3ADA14EABAC1B9A19F46A40A7EBCA5
                                                                                                                                                                                                                      SHA-512:A72F514E8E792ED6F5CD2F629D044417457B1F9E5C3772636086827695E669871885BEE4158C5FF2AEF84054C4CAE9D2AF5FA55B7145780BF11BB4975FE004FC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"valueOut": 0.0999, "vout": [{"spentIndex": 1, "spentHeight": 311327, "value": "0.09890000", "n": 0, "spentTxId": "e8d445189c4158fb01f19514015f85dccc09a680be969f7a26fe74aabbc989f7", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a9146970a648bb72eedba08c2d72eb47b8b704bf5ae388ac", "addresses": ["1AcWuArjpaRJBSYM8LpLk7mgcpEMbGxUNz"], "asm": "OP_DUP OP_HASH160 6970a648bb72eedba08c2d72eb47b8b704bf5ae3 OP_EQUALVERIFY OP_CHECKSIG"}}, {"spentIndex": 0, "spentHeight": 332795, "value": "0.00100000", "n": 1, "spentTxId": "8382a2b2e3ec8788800c1d46d285dfa9dd4051edddd75982fad166b9273e5ac6", "scriptPubKey": {"type": "scripthash", "hex": "a91488376dc8232dbafd959cba5b370be6629506cb1c87", "addresses": ["3E7GDtuHqnqPmDgwH59pVC7AvySiSkbibz"], "asm": "OP_HASH160 88376dc8232dbafd959cba5b370be6629506cb1c OP_EQUAL"}}], "blockhash": "00000000000000000e72b8fdd326aed038bc1e9ed80cdaf2732d62cd10dd2c4d", "valueIn": 0.1, "fees": 0.0001, "vin": [{"addr": "1En8Z9ekdEzdu5gur5f1G9gowv42tbBaSD", "vout": 0, "sequence":

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_bitcoin_tx_c63e24ed820c5851b60c54613fbc4bcb37df6cd49b4c96143e99580a472f79fb.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2568
                                                                                                                                                                                                                      Entropy (8bit):5.1658800730640015
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:Ygt292C092mphYrJ2ha+hVPgkF4ARFnvtwEdmB+PBWl:A92C092mpUJ2M+hVISznvtwEI
                                                                                                                                                                                                                      MD5:3B83F921459615780A63F1E07150C1A7
                                                                                                                                                                                                                      SHA1:916055E6027D0AA44042086532FB8C4CC0559FE5
                                                                                                                                                                                                                      SHA-256:599B1DEF3542DE5F11EE1AAFF8E4216B9576EF24B37B62D13031A6078DCB1C88
                                                                                                                                                                                                                      SHA-512:7226438B28DB2C1AEE0B47B5D6158E649B337905DE8CCEF264E7C88A8F912F70002E81CEBE70E865719CC5BB740FC172DF77654E7E77E7C063AA6EDC0CCD1738
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"valueOut": 0.002, "vout": [{"spentIndex": 29, "spentHeight": 288729, "value": "0.00100000", "n": 0, "spentTxId": "6839c71b7d192a698b5388e9ea921805279cbc9f85bae1019d2f4fe7b326979a", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a9142f4490d5263906e4887ca2996b9e207af3e7824088ac", "addresses": ["15Jvu3nZNP7u2ipw2533Q9VVgEu2Lu9F2B"], "asm": "OP_DUP OP_HASH160 2f4490d5263906e4887ca2996b9e207af3e78240 OP_EQUALVERIFY OP_CHECKSIG"}}, {"spentIndex": 0, "spentHeight": 284875, "value": "0.00100000", "n": 1, "spentTxId": "4a7b7e0403ae5607e473949cfa03f09f2cd8b0f404bf99ce10b7303d86280bf7", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a914812c13d97f9159e54e326b481b8f88a73df8507a88ac", "addresses": ["1CmzyJp9w3NafXMSEFH4SLYUPAVCSUrrJ5"], "asm": "OP_DUP OP_HASH160 812c13d97f9159e54e326b481b8f88a73df8507a OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "0000000000000000ad1b23698d40235f4bc71eb1ab6fa5891ade1fd89b0beb7e", "valueIn": 0.0021, "fees": 0.0001, "vin": [{"addr": "1CK7SJdcb8z9HuvVft3D91HLpLC

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_bitcoin_tx_c6be22d34946593bcad1d2b013e12f74159e69574ffea21581dad115572e031c.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2008
                                                                                                                                                                                                                      Entropy (8bit):5.193549517983418
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:YWyo2JiN2955h62ZXN+IMhM5fx2ZBXcVgEHFayv1y0bTWp4KussfKTZsZ0QWJz8f:Y1o2xJM2G1hcx2MVHZoUjiBI
                                                                                                                                                                                                                      MD5:D188B0D2FF9211CCC4ECA7E71E5BAF42
                                                                                                                                                                                                                      SHA1:712DAF368594E91D37B826A419BCED128352F710
                                                                                                                                                                                                                      SHA-256:808BB5D61CF08DB14EEE5CF3E239288626E17D4DEA1D9DB6A33B2F511D211C03
                                                                                                                                                                                                                      SHA-512:EC8DC6F46A62E987F2575F2F83B61D80544CA95C59562C0839931328695D6E5A4CF115CECE8E6A6FD2E649D18CBFD815A3FE32763CCC5A03860FEAB36AC19980
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"valueOut": 3.33165406, "vout": [{"spentIndex": 27, "spentHeight": 288729, "value": "3.33065406", "n": 0, "spentTxId": "6839c71b7d192a698b5388e9ea921805279cbc9f85bae1019d2f4fe7b326979a", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a91459581dcaf8ed947343b569f1fa2d855d0fc6d9bf88ac", "addresses": ["199QhWMtYE79AG3547QXmZpa8NtLDgme16"], "asm": "OP_DUP OP_HASH160 59581dcaf8ed947343b569f1fa2d855d0fc6d9bf OP_EQUALVERIFY OP_CHECKSIG"}}, {"spentIndex": 0, "spentHeight": 284865, "value": "0.00100000", "n": 1, "spentTxId": "c63e24ed820c5851b60c54613fbc4bcb37df6cd49b4c96143e99580a472f79fb", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a9140223b1a09138753c9cb0baf95a0a62c82711567a88ac", "addresses": ["1CK7SJdcb8z9HuvVft3D91HLpLC6KSsGb"], "asm": "OP_DUP OP_HASH160 0223b1a09138753c9cb0baf95a0a62c82711567a OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "0000000000000000371eecb3a4a9e2347cd8971b9a50a63ef2a7276c3a5e2ca7", "valueIn": 3.33175406, "fees": 0.0001, "vin": [{"addr": "1FSAF2vZ47XnyiF7Cuv

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_bitcoin_tx_d1d08ea63255af4ad16b098e9885a252632086fa6be53301521d05253ce8a73d.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1789
                                                                                                                                                                                                                      Entropy (8bit):5.2160500955448965
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:Y/Cs85vJ8KA8L/6wV2U6QmBPjG276B27qpmGq:Ayv2U6RtG276B270pq
                                                                                                                                                                                                                      MD5:AA428BE2A80833808F900139E530DC29
                                                                                                                                                                                                                      SHA1:E4412293335DC34BC09A05D888B29A93E26B300F
                                                                                                                                                                                                                      SHA-256:44BF0492F732F96A439A7FE16685437A28FB53846826268356E40A192695ED78
                                                                                                                                                                                                                      SHA-512:2CFE453D093D23C90543348A4C59C06542051D28EFDD324DA8838C840376621317B327089D8553D7F0F4B97FE8A6D7251170A4119EF35D26EF664093F861FE9D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"valueOut": 0.1877507, "vout": [{"spentIndex": null, "spentHeight": null, "value": "0.00100000", "n": 0, "spentTxId": null, "scriptPubKey": {"type": "scripthash", "hex": "a914a4efc33d43d7a8a0040182c76ab624ff862f50d287", "addresses": ["3Gj7y1FdTppx2JEDqYqAEZFnKCA4GRysKF"], "asm": "OP_HASH160 a4efc33d43d7a8a0040182c76ab624ff862f50d2 OP_EQUAL"}}, {"spentIndex": 0, "spentHeight": 337674, "value": "0.18675070", "n": 1, "spentTxId": "1956152a945836ca835a04c0fbdbb1257bc9c24756f42c77dd1ed3c3fe1a94ac", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a914167b282e46a22588d2746831f3dce2c37f6e70da88ac", "addresses": ["133sQKJfa4h55cwa5RcPAh5fmFA1SrELGJ"], "asm": "OP_DUP OP_HASH160 167b282e46a22588d2746831f3dce2c37f6e70da OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "0000000000000000177e78336482934c0f6826510464c5405490db118300dfab", "valueIn": 0.1878507, "fees": 0.0001, "vin": [{"addr": "12rApVsmCUHnPESfL3ycgTaQY7M6QrmY7j", "vout": 0, "sequence": 4294967295, "doubleSpentTxID": null, "value": 0.187

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_bitcoin_tx_d5f65ee80147b4bcc70b75e4bbf2d7382021b871bd8867ef8fa525ef50864882.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2411
                                                                                                                                                                                                                      Entropy (8bit):5.015299557946149
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:Y0/aLBDRQWLE28wpGgbQqn/WnUYv4AyYs4AFYR2+:x/aLrLE28wpZxn/Wn74AG4A+X
                                                                                                                                                                                                                      MD5:7069970CC313514AB3C03ECA38FDA1CF
                                                                                                                                                                                                                      SHA1:C923B27ED377C8CD2A60BDC55702BB3FF7AAF363
                                                                                                                                                                                                                      SHA-256:04BE231FBC959B3454114650BA90CF8E073C085593BD686F8D316D6BA6785503
                                                                                                                                                                                                                      SHA-512:8782DFDB02B19C0FF47E4746E6EBA44B404DFC6B66FBD56703C76A89D2EFE0B56BEC43B2CE072393F1BDAF1399A99A632F55F2432F0FD7F0C831C2960B35F516
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"valueOut": 0.0039, "vout": [{"spentIndex": 0, "spentHeight": 280227, "value": "0.00390000", "n": 0, "spentTxId": "fd79435246dee76b2f159d2db08032d666c95adc544de64c8c49f474df4a7fee", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a91424a56db43cf6f2b02e838ea493f95d8d6047423188ac", "addresses": ["14LmW5k4ssUrtbAB4255zdqv3b4w1TuX9e"], "asm": "OP_DUP OP_HASH160 24a56db43cf6f2b02e838ea493f95d8d60474231 OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "00000000000000011dec345ceae0765c98c72bdcb7cdd83e749ad37bbc3104cc", "valueIn": 0.004, "fees": 0.0001, "vin": [{"addr": "19qyPUSAXJ8cHw6TxZ6FYQFZdLMdJA7A2t", "vout": 1, "sequence": 4294967295, "doubleSpentTxID": null, "value": 0.002, "n": 0, "valueSat": 200000, "txid": "c16a03f1cf8f99f6b5297ab614586cacec784c2d259af245909dedb0e39eddcf", "scriptSig": {"hex": "483045022072ba61305fe7cb542d142b8f3299a7b10f9ea61f6ffaab5dca8142601869d53c0221009a8027ed79eb3b9bc13577ac2853269323434558528c6b6a7e542be46e7e9a820141047a2d177c0f3626fc68c53610b0270fa6156181f4658

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_bitcoin_tx_e4bc1ae5e5007a08f2b3926fe11c66612e8f73c6b00c69c7027213b84d259be3.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1787
                                                                                                                                                                                                                      Entropy (8bit):5.223993853654979
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:Y2H2T1juY1D2eCeANE4ILoXqcY3DzpxNzfzpoNzhXB8Q:pHNS2ekE4ILo6x3ZxNzloNzhf
                                                                                                                                                                                                                      MD5:06AEF6733A9DCB8F9ABA5E7410632DBF
                                                                                                                                                                                                                      SHA1:3F8D8E8650CE3CE1C21DC66EB6C5424B916679A9
                                                                                                                                                                                                                      SHA-256:EE0BEB9A223AA70E0DB4F62F8179B6549AF6CF0109F9BDD015A65F959FE3C9F6
                                                                                                                                                                                                                      SHA-512:7A9A3F23BCA9E92E6CD6F75F00841FB130796C0FCA49F5097DC7C50FDCC515A19CD97C5D2BF0EBEF1CD9DA9264CDECB0FA3368CCD2909E4F3E853D2B401E3CF3
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"valueOut": 0.02152478, "vout": [{"spentIndex": 0, "spentHeight": 338362, "value": "0.02052478", "n": 0, "spentTxId": "e8e0b3b3a10a5f7914abc7b6a0e6e6e35ec8944a81bb279701d5ce22c794d8fc", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a914e6271f1394b1e25d976d0957cb2b36aeb1d875c588ac", "addresses": ["1MywHKjaict4ceqJ2SS414FtyfSgPDamn9"], "asm": "OP_DUP OP_HASH160 e6271f1394b1e25d976d0957cb2b36aeb1d875c5 OP_EQUALVERIFY OP_CHECKSIG"}}, {"spentIndex": null, "spentHeight": null, "value": "0.00100000", "n": 1, "spentTxId": null, "scriptPubKey": {"type": "scripthash", "hex": "a9143e03a6446f27e2a0c1366b375a275c758e21edfa87", "addresses": ["37LvC1Q5CyKbMbKMncEJdXxqGhHxrBEgPE"], "asm": "OP_HASH160 3e03a6446f27e2a0c1366b375a275c758e21edfa OP_EQUAL"}}], "blockhash": "000000000000000000f2c3875e9e7998fee70fe9d3961900230fafa55201d375", "valueIn": 0.02162478, "fees": 0.0001, "vin": [{"addr": "1JreWorDp4fm2tqPR9ntUXApyXUZPR7LSP", "vout": 1, "sequence": 4294967295, "doubleSpentTxID": null, "value": 0.0

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_decred_testnet_tx_16da185052740d85a630e79c140558215b64e26c500212b90e16b55d13ca06a8.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1829
                                                                                                                                                                                                                      Entropy (8bit):5.236233983638887
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:Y7MujMngzt8RE0jjFXCW3hKk9tDg+vy9hKk9tDg+qyLHrhBjpHjlZW5MGlklZW55:Y7jMFG0XcCOcC9HrLj7pL2sexyhxO
                                                                                                                                                                                                                      MD5:ED5D45EDEAAD24BDF7A90176FCCF8DA8
                                                                                                                                                                                                                      SHA1:8198BB76ADE2EE2D6D2AD33AD4F900C67F598DA7
                                                                                                                                                                                                                      SHA-256:342673D54684E3F3BADCCAF59131E60C7935102F33F0D7C4D0E1321A07941241
                                                                                                                                                                                                                      SHA-512:33905B9871F668267A41E072292799F63CFDA3B55E880E00329DAE3E20C978AE245AC550F5F067787F93102E2E651CECCB6CB4CA61F835784D359B6A8EF1C7EE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"txid": "16da185052740d85a630e79c140558215b64e26c500212b90e16b55d13ca06a8", "version": 1, "locktime": 0, "expiry": 0, "vin": [{"txid": "157b2c4740d22f9c1ab6e21f267159e453abad418e5d686730c33d926978380c", "vout": 2, "tree": 0, "sequence": 4294967295, "amountin": "5.71370733", "blockheight": 199736, "blockindex": 0, "scriptSig": {"asm": "3044022064b5d90720e600a30df2206456ab5d8dc8b15fb9ca368f459c8818163bc0811b0220337225cd791d137de24cf147c14ea3e24d627a894480a031f372291e2a7c802801 02c72f904e641e92db3df2100bcfb79dca731c2f27cf71d43dc8904744ca4d2e0b", "hex": "473044022064b5d90720e600a30df2206456ab5d8dc8b15fb9ca368f459c8818163bc0811b0220337225cd791d137de24cf147c14ea3e24d627a894480a031f372291e2a7c8028012102c72f904e641e92db3df2100bcfb79dca731c2f27cf71d43dc8904744ca4d2e0b"}, "n": 0, "addr": "TsexEoyMS79mFwmAJdi33X7n7dffG5J6wd5", "valueSat": 571370733, "value": "5.71370733", "doubleSpentTxID": null, "isConfirmed": true, "confirmations": 97, "unconfirmedInput": false}], "vout": [{"value": "2.0000000

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_decred_testnet_tx_3f7c395521d38387e7617565fe17628723ef6635a08537ad9c46cfb1619e4c3f.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1833
                                                                                                                                                                                                                      Entropy (8bit):5.243253136344625
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:YEw04vKUHwUHmHrCkjQ4NT2fttB9fcSyqNAg:pw04yVPHrzT2jcSyu
                                                                                                                                                                                                                      MD5:F7C51D619E667AEB12DD9F1BD5EF368B
                                                                                                                                                                                                                      SHA1:79630C379905F54E3C0E707DA4E079D2C4DC99D5
                                                                                                                                                                                                                      SHA-256:7D66C40CFD86D268538ACBBAD7D58EE777425A4BD04B9B5513F48E0B92A03DC6
                                                                                                                                                                                                                      SHA-512:7BEA3F57FFEC5B9620B7388E6FAABEAB8B29CD10913AB572BC1C4FD09395B6069457769D5EF090389E5C4F40BC4BB5A8B3B46D911C8E6A114A5A33BA55F95937
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"txid": "3f7c395521d38387e7617565fe17628723ef6635a08537ad9c46cfb1619e4c3f", "version": 1, "locktime": 0, "expiry": 0, "vin": [{"txid": "0e12c16e0e18eab7b14c28f8273588803fad511aaad3c24d5cdc5a2e5556bc05", "vout": 2, "tree": 0, "sequence": 4294967295, "amountin": "3.42822438", "blockheight": 199752, "blockindex": 0, "scriptSig": {"asm": "3045022100ee07ae6d21a13fbc151e3d5381eaafd1976315020e68676d664ccedea38c78740220396dd0de4f8fd905bb1c944f39ff3af97479a5cb834fa7776680eb264fae749501 02c72f904e641e92db3df2100bcfb79dca731c2f27cf71d43dc8904744ca4d2e0b", "hex": "483045022100ee07ae6d21a13fbc151e3d5381eaafd1976315020e68676d664ccedea38c78740220396dd0de4f8fd905bb1c944f39ff3af97479a5cb834fa7776680eb264fae7495012102c72f904e641e92db3df2100bcfb79dca731c2f27cf71d43dc8904744ca4d2e0b"}, "n": 0, "addr": "TsexEoyMS79mFwmAJdi33X7n7dffG5J6wd5", "valueSat": 342822438, "value": "3.42822438", "doubleSpentTxID": null, "isConfirmed": true, "confirmations": 81, "unconfirmedInput": false}], "vout": [{"value": "1.427

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_decred_testnet_tx_5e6e3500a333c53c02f523db5f1a9b17538a8850b4c2c24ecb9b7ba48059b970.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1509
                                                                                                                                                                                                                      Entropy (8bit):5.195923662479774
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:Y7MjOigzKcoUs0FyHCWuQVeAhIQVeAgsTLjfHJlZW5L1aa2Zbl1a9NaTDcivITrn:Y5oUs0oY2e2/jIsa2Xs8vWrn
                                                                                                                                                                                                                      MD5:2577CB1026B83A2D8D4EB11ABA94D088
                                                                                                                                                                                                                      SHA1:3552312252FC0F8E5CAA7461BB383B78EE99E6EF
                                                                                                                                                                                                                      SHA-256:5949881A3EB54D1900FD28F2B240C2A18C205732894A3680E96F1E382805C606
                                                                                                                                                                                                                      SHA-512:692CD45501866769F28ADA77EDCA07C20D953CD88418A573BA50041293BEADD8872A60465BBA34A099E6F4A5BF81981848A27CBD302A3B74D2C4A609B2B36D04
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"txid": "5e6e3500a333c53c02f523db5f1a9b17538a8850b4c2c24ecb9b7ba48059b970", "version": 1, "locktime": 0, "expiry": 0, "vin": [{"txid": "e16248f0b39a0a0c0e53d6f2f84c2a944f0d50e017a82701e8e02e46e979d5ed", "vout": 1, "tree": 0, "sequence": 4294967295, "amountin": 2, "blockheight": 192676, "blockindex": 1, "scriptSig": {"asm": "3045022100bad68486491e449a731513805c129201d7f65601d6f07c97fda0588453c97d22022013e9ef59657ae4f344ac4f0db2b7a23dbfcdb51ebeb85277146ac189e547d3f701 02f5a745afb96077c071e4d19911a5d3d024faa1314ee8688bc6eec39751d0818f", "hex": "483045022100bad68486491e449a731513805c129201d7f65601d6f07c97fda0588453c97d22022013e9ef59657ae4f344ac4f0db2b7a23dbfcdb51ebeb85277146ac189e547d3f7012102f5a745afb96077c071e4d19911a5d3d024faa1314ee8688bc6eec39751d0818f"}, "n": 0, "addr": "TscqTv1he8MZrV321SfRghw7LFBCJDKB3oz", "valueSat": 200000000, "value": 2, "doubleSpentTxID": null, "isConfirmed": true, "confirmations": 6387, "unconfirmedInput": false}], "vout": [{"value": "1.90000000", "n": 0, "ver

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_decred_testnet_tx_ccf95b0fd220ef59ae2e5b17005a81e222758122682d522eff8ae1fcbc93bc74.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1865
                                                                                                                                                                                                                      Entropy (8bit):5.276277826643442
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:Y7MrEvgzBT+k6s0NfTXCWT21DFbKO21DFb1/5jzHRlZW5D2Z4pNL5lZW5L1aa2Zp:YOTd6s0b2xZKO2xZ1RjY2Nsa2Xsg4b+
                                                                                                                                                                                                                      MD5:4EF2B9B53E792AB97E944F8B4DF670FC
                                                                                                                                                                                                                      SHA1:CE9FE3E3170268C8B2ED8822F4F3B656F71DE5C9
                                                                                                                                                                                                                      SHA-256:EEF6B907580DD294C7D306E0F007AB1C6AD25A6DD2462A271F247456486B1AD4
                                                                                                                                                                                                                      SHA-512:FFFF8FF777EC90BF12AA715AE14AFB8D80F2195A3E38CE2F45A457C3F485F0B22922D4EE9EDCE989E20493F0502C1919960D23FEA06DCAAF29AEC6584B6DB6F5
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"txid": "ccf95b0fd220ef59ae2e5b17005a81e222758122682d522eff8ae1fcbc93bc74", "version": 1, "locktime": 0, "expiry": 0, "vin": [{"txid": "bcc56f8b646c787d505275a7ab174fb060b028dcc4469e9a4d8391224fe67515", "vout": 2, "tree": 0, "sequence": 4294967295, "amountin": "4.86000277", "blockheight": 186396, "blockindex": 0, "scriptSig": {"asm": "304502210094eb39bdfaa3236cf211c8249cf82603c0b7275dc59dc7b27936806e20a063b90220691aa71e9a0ab246a1dc4568c0ad4b5202d35ed0639fe64da17085701303e21801 02ae1f6b51086bd753f072f94eb8ffe6806d3570c088a3ede46c678b6ea47d1675", "hex": "48304502210094eb39bdfaa3236cf211c8249cf82603c0b7275dc59dc7b27936806e20a063b90220691aa71e9a0ab246a1dc4568c0ad4b5202d35ed0639fe64da17085701303e218012102ae1f6b51086bd753f072f94eb8ffe6806d3570c088a3ede46c678b6ea47d1675"}, "n": 0, "addr": "TseH9wPe4bfRqS2qwceAyjzNGFrMAPgzkvB", "valueSat": 486000277, "value": "4.86000277", "doubleSpentTxID": null, "isConfirmed": true, "confirmations": 12667, "unconfirmedInput": false}], "vout": [{"value": "2.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_decred_testnet_tx_e16248f0b39a0a0c0e53d6f2f84c2a944f0d50e017a82701e8e02e46e979d5ed.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1974
                                                                                                                                                                                                                      Entropy (8bit):5.264708001562207
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:YZoUCHH04gwSl/DTl+6YBjD2Psa2Xsk+yxl:04n04gLtvYBH2Ea28k+gl
                                                                                                                                                                                                                      MD5:D28F8311CF0183619DD027F5AAC9EC52
                                                                                                                                                                                                                      SHA1:D6A7177F5CA8A68ADC7468709D464ADAA308CB4E
                                                                                                                                                                                                                      SHA-256:C9673ACF611E0313967B014E89DCD4239EA71AA7C5519E8C7D31F076C4ABE25A
                                                                                                                                                                                                                      SHA-512:BDDC227F1D7C56CC9B357E83DDC2419D6FCFD73C93C673AD2DE30738FD8CED67F7DCDF4E63D15B638E3264A8E229BED44D2FB9E0B502C24721E3289DCB6F83DA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"txid": "e16248f0b39a0a0c0e53d6f2f84c2a944f0d50e017a82701e8e02e46e979d5ed", "version": 1, "locktime": 0, "expiry": 0, "vin": [{"txid": "21012b08c5077036460e8f75bbc57beb11d7bc30e7ad224ad5e67d15bd086500", "vout": 2, "tree": 0, "sequence": 4294967295, "amountin": "3.53210301", "blockheight": 192566, "blockindex": 0, "scriptSig": {"asm": "304402207d127d59a44187952d9d0de94ad34a19dd9a84beb124fd8a3fb439c862544d3202206618f321385c30bda96fb01ce03f70a269d78a301c0b0c2e3e3689dfae3f473301 02ae1f6b51086bd753f072f94eb8ffe6806d3570c088a3ede46c678b6ea47d1675", "hex": "47304402207d127d59a44187952d9d0de94ad34a19dd9a84beb124fd8a3fb439c862544d3202206618f321385c30bda96fb01ce03f70a269d78a301c0b0c2e3e3689dfae3f4733012102ae1f6b51086bd753f072f94eb8ffe6806d3570c088a3ede46c678b6ea47d1675"}, "n": 0, "addr": "TseH9wPe4bfRqS2qwceAyjzNGFrMAPgzkvB", "valueSat": 353210301, "value": "3.53210301", "doubleSpentTxID": null, "isConfirmed": true, "confirmations": 5745, "unconfirmedInput": false}], "vout": [{"value": "1.53185

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_decred_testnet_tx_f395ef3e72a831a766db15e7a38bc28025d4ee02234d68bdea2d8353b47a3113.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1860
                                                                                                                                                                                                                      Entropy (8bit):5.289824419731842
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:Y6uKZntSZC0ZYta7YtlxjwZ32/gO152kkAgRMSW/w:IOyC0Ie32/F52kkaw
                                                                                                                                                                                                                      MD5:EABA0AD56C716EC4D1E9F30EE56080D7
                                                                                                                                                                                                                      SHA1:34FB4806960061CBDA0252DB4394985FB927DC64
                                                                                                                                                                                                                      SHA-256:BB3C477FA38134064C9E65609471742C91FD3D05FF331F6FC3EE5A601EB470F5
                                                                                                                                                                                                                      SHA-512:AA0A01125337860345679DACD64400FE1EFF9B49A55CB386226F3538421867866C7AEA4FFC5C47924EE2C9327C1B115CEC6A58E1B9DB2A19F31F3C1572771CC6
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"txid": "f395ef3e72a831a766db15e7a38bc28025d4ee02234d68bdea2d8353b47a3113", "version": 1, "locktime": 0, "expiry": 0, "vin": [{"txid": "e1b86d7694cf3bf9c83188bdb380892b85cd82a31410b09e267a745caaab7715", "vout": 2, "tree": 0, "sequence": 4294967295, "amountin": "6.18712631", "blockheight": 184001, "blockindex": 0, "scriptSig": {"asm": "304402205de1a5bd40d551f77cd2a60d58767f92baa265ec99808ad14afe571682498e9b022054d148cd29d287e3e22d700b99e6a30823a9584a5db5e4ba26f4e60f613b4cc901 02ae1f6b51086bd753f072f94eb8ffe6806d3570c088a3ede46c678b6ea47d1675", "hex": "47304402205de1a5bd40d551f77cd2a60d58767f92baa265ec99808ad14afe571682498e9b022054d148cd29d287e3e22d700b99e6a30823a9584a5db5e4ba26f4e60f613b4cc9012102ae1f6b51086bd753f072f94eb8ffe6806d3570c088a3ede46c678b6ea47d1675"}, "n": 0, "addr": "TseH9wPe4bfRqS2qwceAyjzNGFrMAPgzkvB", "valueSat": 618712631, "value": "6.18712631", "doubleSpentTxID": null, "isConfirmed": true, "confirmations": 15062, "unconfirmedInput": false}], "vout": [{"value": "2.0000

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_testnet_tx_09144602765ce3dd8f4329445b20e3684e948709c5cdcaf12da3bb079c99448a.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1397
                                                                                                                                                                                                                      Entropy (8bit):5.147066625408129
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:YrQa8lMkVU2er+9nQU2eLrGlM8v9T3cstX4L644LunOsWo8N+D+GUn:YMFMnwX6l/lT3fU0onQn
                                                                                                                                                                                                                      MD5:BD3EDEA1C6869561288E5DD25DF0A607
                                                                                                                                                                                                                      SHA1:EBBFF10AD7C8AB1DA951E5E56DED97ADB8C16876
                                                                                                                                                                                                                      SHA-256:6274F1DE3BAAD47AAC48E0331DFDBF9A1BAA2EE19F31E2B9F0098A9ED76AF701
                                                                                                                                                                                                                      SHA-512:2256BB34DADC1688B2DCB59C440B7E3CCE151EDB3934651CF3C114C46E446FF3986815AAC8A14CC4A54D71046C52FACFFA5DBEFD4B969BEDB08BE225B6AA52F4
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"valueOut": 1.23445789, "vout": [{"spentIndex": 0, "spentHeight": 1063388, "value": "0.12300000", "n": 0, "spentTxId": "65b811d3eca0fe6915d9f2d77c86c5a7f19bf66b1b1253c2c51cb4ae5f0c017b", "scriptPubKey": {"hex": "00140099a7ecbd938ed1839f5f6bf6d50933c6db9d5c", "asm": "0 0099a7ecbd938ed1839f5f6bf6d50933c6db9d5c"}}, {"spentIndex": 0, "spentHeight": 1063500, "value": "1.11145789", "n": 1, "spentTxId": "0e480a97c7a545c85e101a2f13c9af0e115d43734e1448f0cac3e55fe8e7399d", "scriptPubKey": {"type": "scripthash", "hex": "a91458b53ea7f832e8f096e896b8713a8c6df0e892ca87", "addresses": ["2N1LGaGg836mqSQqiuUBLfcyGBhyZbremDX"], "asm": "OP_HASH160 58b53ea7f832e8f096e896b8713a8c6df0e892ca OP_EQUAL"}}], "blockhash": "00000000c55ba0613303aa56e7381aa03236cd7f2ab63eb4b8ff4658f8ec2180", "valueIn": 1.23456789, "fees": 0.00011, "vin": [{"addr": "2N1LGaGg836mqSQqiuUBLfcyGBhyZbremDX", "vout": 0, "sequence": 4294967295, "doubleSpentTxID": null, "value": 1.23456789, "n": 0, "valueSat": 123456789, "txid": "20912f98e

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_testnet_tx_16c6c8471b8db7a628f2b2bb86bfeefae1766463ce8692438c7fd3fce3f43ce5.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1792
                                                                                                                                                                                                                      Entropy (8bit):5.224493432883447
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:Y7B6XI8WvbAWvaOI21AKnKcKSoWRcv0O4O0:QywA5OI21ASoWRO50
                                                                                                                                                                                                                      MD5:940DBDBB4E50CF164288129B4D31ED2E
                                                                                                                                                                                                                      SHA1:88F4B27B13D89002AF360DDAD6CC941D04E370F4
                                                                                                                                                                                                                      SHA-256:3EE7A1479CEA97DF72A13D103EF4FFDD63795D9209470E8AEFE2E8A7B6F477BC
                                                                                                                                                                                                                      SHA-512:3D77FADD3D4B75A0D453901946B2E102C99786CDA8A1CAC4CCA6498A7838CDE45409A908018D5D668BD5FE38D6F64C5547F4535225F3CCB6AFD9D5856696F187
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"txid": "16c6c8471b8db7a628f2b2bb86bfeefae1766463ce8692438c7fd3fce3f43ce5", "version": 1, "locktime": 0, "vin": [{"txid": "3143f555a21753fbf3f095e27823122c4107393bb388aca736bd613e91192be4", "vout": 1, "sequence": 4294967295, "n": 0, "scriptSig": {"hex": "483045022100a2d3237b16795b10b33c19651261f9b9d1f8a0143f87f749adcc84e3d0b8f38702205ab3f80431af41091a01c946586b68fc843c8341738656cea70e25b0d0be2c970121024e6f7ddfe8c050649c7d3291f07e188c3fe779fb71954f8d00eaf1eff9af958e", "asm": "3045022100a2d3237b16795b10b33c19651261f9b9d1f8a0143f87f749adcc84e3d0b8f38702205ab3f80431af41091a01c946586b68fc843c8341738656cea70e25b0d0be2c97[ALL] 024e6f7ddfe8c050649c7d3291f07e188c3fe779fb71954f8d00eaf1eff9af958e"}, "addr": "mso9GMbZncQ767FQhkuMK8n4L4uQxDTFAA", "valueSat": 277569531, "value": 2.77569531, "doubleSpentTxID": null}], "vout": [{"value": "2.27568531", "n": 0, "scriptPubKey": {"hex": "76a9140889daec397047b8c6cce0080ba6c5455b443a8188ac", "asm": "OP_DUP OP_HASH160 0889daec397047b8c6cce0080ba6c5455b443a8

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_testnet_tx_20912f98ea3ed849042efed0fdac8cb4fc301961c5988cba56902d8ffb61c337.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1787
                                                                                                                                                                                                                      Entropy (8bit):5.258847704506951
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:YLOsWo7U2er+9nQU2eLUCdNUZTa53Zu2ZBGlMO31hwIc2ONikH2ciHbEA3HONikW:YL0oGwXUCUuo2Glt31vrEOr7J6I
                                                                                                                                                                                                                      MD5:972B8FF01FF2E7B05A038B88C84B5F31
                                                                                                                                                                                                                      SHA1:561249E73E72FC49D9E9BD8F74ACBDBE202A4438
                                                                                                                                                                                                                      SHA-256:BE3B35BB3F3DB92F93D7D33EA5CFCB8353404B321493A0AEC859E417B76F57C8
                                                                                                                                                                                                                      SHA-512:B5A1B5F2FD84E1FCBB2DFBF9FF87613D4257DB17DE7E0C215775E39D0A72CD32B0050AF6B2B00F2879CAA1D036B9F33EB9D0F742ADE4BEB18AD7F09C91CA7FFF
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"valueOut": 9.88976097, "vout": [{"spentIndex": 0, "spentHeight": 1063386, "value": "1.23456789", "n": 0, "spentTxId": "09144602765ce3dd8f4329445b20e3684e948709c5cdcaf12da3bb079c99448a", "scriptPubKey": {"type": "scripthash", "hex": "a91458b53ea7f832e8f096e896b8713a8c6df0e892ca87", "addresses": ["2N1LGaGg836mqSQqiuUBLfcyGBhyZbremDX"], "asm": "OP_HASH160 58b53ea7f832e8f096e896b8713a8c6df0e892ca OP_EQUAL"}}, {"spentIndex": null, "spentHeight": null, "value": "8.65519308", "n": 1, "spentTxId": null, "scriptPubKey": {"type": "pubkeyhash", "hex": "76a914b84bacdcd8f4cc59274a5bfb73f804ca10f7fd1488ac", "addresses": ["mxKRHMmxvjY7RmZR4CJXPfGWpF6cMQEiM5"], "asm": "OP_DUP OP_HASH160 b84bacdcd8f4cc59274a5bfb73f804ca10f7fd14 OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "00000000c55ba0613303aa56e7381aa03236cd7f2ab63eb4b8ff4658f8ec2180", "valueIn": 9.8899, "fees": 0.00013903, "vin": [{"addr": "n173UNnYvJQ7tZFNmQqgchKgSZY5scpxNw", "vout": 0, "sequence": 4294967295, "doubleSpentTxID": null, "value": 9

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_testnet_tx_31bc1c88ce6ae337a6b3057a16d5bad0b561ad1dfc047d0a7fbb8814668f91e5.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):980
                                                                                                                                                                                                                      Entropy (8bit):5.166168212444558
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:YlTJv/XeqACegmlVoNT7L+F+F8T7L4AnTcFxVQY9F07SsZ+eS8Mo:Ylsaf8kAnT0VQY9F+1keF
                                                                                                                                                                                                                      MD5:9820B34134E0FF9E5E147554CB00952A
                                                                                                                                                                                                                      SHA1:EFE8DD0C1F64D271990BDEFA14132150D363F5DC
                                                                                                                                                                                                                      SHA-256:437B0B9FC14A0080411BD971C8E26E8D845202C70BD9253BA6EDD3D977AFA47C
                                                                                                                                                                                                                      SHA-512:0E7EB0A6B9F7345E6689C597EDFCDC34E38A7588E051226E14BC55D4868D8AACA6485392534D57ADBDF63FC36BEA7DE0EB3543684B259ABAB56CC92C245F3D72
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"valueOut": 0.01603, "vout": [{"spentIndex": 0, "spentHeight": 1112864, "value": "0.01603000", "n": 0, "spentTxId": "c0bf56060a109624b4635222696d94a7d533cacea1b3f8245417a4348c045829", "scriptPubKey": {"type": "scripthash", "hex": "a914a8655acf68f785125561158b0f4db9b5d004404787", "addresses": ["2N8bcvm7XKX64fXnwRErbH4jgZSfBvQAzQp"], "asm": "OP_HASH160 a8655acf68f785125561158b0f4db9b5d0044047 OP_EQUAL"}}], "blockhash": "0000000000004cfcd096863f3f9a749907c0cc160446e17cdae2863735ba2fe9", "valueIn": 0.01604, "fees": 1e-05, "vin": [{"addr": null, "vout": 0, "sequence": 4294967295, "doubleSpentTxID": null, "value": 0.01604, "n": 0, "valueSat": 1604000, "txid": "c9348040bbc2024e12dcb4a0b4806b0398646b91acf314da028c3f03dd0179fc", "scriptSig": {"hex": "", "asm": null}}], "txid": "31bc1c88ce6ae337a6b3057a16d5bad0b561ad1dfc047d0a7fbb8814668f91e5", "blocktime": 1490794732, "version": 1, "confirmations": 8736, "time": 1490794732, "blockheight": 1112862, "locktime": 0, "size": 83}

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_testnet_tx_65b811d3eca0fe6915d9f2d77c86c5a7f19bf66b1b1253c2c51cb4ae5f0c017b.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1262
                                                                                                                                                                                                                      Entropy (8bit):5.118529297121093
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:Y/WE2vieeAtd5MkE4L6Wk4LuJR7W+FYnOsWouy2m+lfwn:Y/Wh6eeid5MYV+Yn0otEdm
                                                                                                                                                                                                                      MD5:5C5A07233E3130B0D93A706CB488BD33
                                                                                                                                                                                                                      SHA1:21100F4D3E39CB0B45F2669772FAD7673C286547
                                                                                                                                                                                                                      SHA-256:520BC64480F16E4F59676068A09ED33A21CD3BD6BA78089B648FCAC9AA6E95F0
                                                                                                                                                                                                                      SHA-512:3ECCD89548DE5035983637DEBC6E608B6D581C0601C8062835DCBA5577AD4BD573850709C1354B4EF58B67A9FD95481B853A6ECF41D847D6844C15B9FCE2C2B9
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"valueOut": 0.12289, "vout": [{"spentIndex": 0, "spentHeight": 1117152, "value": "0.05000000", "n": 0, "spentTxId": "0003c7cd0951f40acb2b7d9de20f87730971f9c6378012c8d3f94a0b56c57ab3", "scriptPubKey": {"type": "scripthash", "hex": "a9147a55d61848e77ca266e79a39bfc85c580a6426c987", "addresses": ["2N4Q5FhU2497BryFfUgbqkAJE87aKHUhXMp"], "asm": "OP_HASH160 7a55d61848e77ca266e79a39bfc85c580a6426c9 OP_EQUAL"}}, {"spentIndex": 1, "spentHeight": 1063500, "value": "0.07289000", "n": 1, "spentTxId": "0e480a97c7a545c85e101a2f13c9af0e115d43734e1448f0cac3e55fe8e7399d", "scriptPubKey": {"hex": "0014d16b8c0680c61fc6ed2e407455715055e41052f5", "asm": "0 d16b8c0680c61fc6ed2e407455715055e41052f5"}}], "blockhash": "000000005e99726b20f3909411cef2d67f7fe489e53df5ebb1358671076bebfa", "valueIn": 0.123, "fees": 0.00011, "vin": [{"addr": null, "vout": 0, "sequence": 4294967295, "doubleSpentTxID": null, "value": 0.123, "n": 0, "valueSat": 12300000, "txid": "09144602765ce3dd8f4329445b20e3684e948709c5cdcaf12da3bb07

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_testnet_tx_6f90f3c7cbec2258b0971056ef3fe34128dbde30daa9c0639a898f9977299d54.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2515
                                                                                                                                                                                                                      Entropy (8bit):5.18341209273868
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:Yn7WOeT2SCAL6wLE26Yp6ZEHHEozPwvBEozPwvJmqlwEXwp0C:VT2SpL6wLE26esqzI5zIRtC
                                                                                                                                                                                                                      MD5:15007251A08EFD6CB491ECC76ADC55EC
                                                                                                                                                                                                                      SHA1:24A10071A74DF07044F2146DF416CF625C1C728D
                                                                                                                                                                                                                      SHA-256:532AF35EE11DBBEC87FB94D810FB8D50CDA6F2BEC40DD09C925A297C8F2645C6
                                                                                                                                                                                                                      SHA-512:A13FA6793EDDEDFC472596DE4A3C4A5C7EC76CF16FA966C81E0467C1F06B1BF0BE3446B1BF9E6E1C342DD07789D7D584583C2F3F33B5B69CB8739EDC71297A3D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"valueOut": 14.03850989, "vout": [{"spentIndex": 0, "spentHeight": 203911, "value": "4.03850989", "n": 0, "spentTxId": "5170fe1f25a05e1c9e125c27cd09e11f7c79c41409bc5b68f0e6f056af2d56b0", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a914f5a05c2664b40d3116b1c5086c9ba38ed15b742e88ac", "addresses": ["n3uhx4JymCrWKX3e9i59YdJivMghF1bKZ4"], "asm": "OP_DUP OP_HASH160 f5a05c2664b40d3116b1c5086c9ba38ed15b742e OP_EQUALVERIFY OP_CHECKSIG"}}, {"spentIndex": null, "spentHeight": null, "value": "10.00000000", "n": 1, "spentTxId": null, "scriptPubKey": {"type": "pubkeyhash", "hex": "76a91424a56db43cf6f2b02e838ea493f95d8d6047423188ac", "addresses": ["mirio8q3gtv7fhdnmb3TpZ4EuafdzSs7zL"], "asm": "OP_DUP OP_HASH160 24a56db43cf6f2b02e838ea493f95d8d60474231 OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "000000006656e1d72a211b7f469dd85209ba85c54127957a95591712a63d3848", "valueIn": 14.03850989, "fees": 0, "vin": [{"addr": "mnsfHtywp6AVUzgqu9P4tay6iQYY3WhCpz", "vout": 1, "sequence": 4294967295, "doubleSpe

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_testnet_tx_9c31922be756c06d02167656465c8dc83bb553bf386a3f478ae65b5c021002be.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1790
                                                                                                                                                                                                                      Entropy (8bit):5.233079132851722
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:YGQCf89Y2AHGKx95XDf2TwlTjc1jNPljFHV:wG8y2AHGKL5XDuTwFjc1jNdZV
                                                                                                                                                                                                                      MD5:59C0DCA43DE4E6AD2B2BB3C8B3BD4FD4
                                                                                                                                                                                                                      SHA1:25953C37DAB5FCF2B3C305A74EB3ECE4CD7A0F18
                                                                                                                                                                                                                      SHA-256:D1458AAABA4D8CBFA3850A8639CF9F11C786A6062971478EF694AD9E63DB4D24
                                                                                                                                                                                                                      SHA-512:D2D80AC4C628A0DFC37E8E73F2AEAF19B7AF4C57681292C3AF96B5368FB130808FA1D58F77F22ABED8F5D5BAB17758965F73C22458CB8D5E3EE4C2BAD3C3EDF9
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"valueOut": 0.135346, "vout": [{"spentIndex": null, "spentHeight": null, "value": "0.11924164", "n": 0, "spentTxId": null, "scriptPubKey": {"type": "pubkeyhash", "hex": "76a914b6fc54e2f7c490ba20c686f532bfb02230656dbf88ac", "addresses": ["mxCVZGoYAmscorbmaaPjRHrRUMHihGmex5"], "asm": "OP_DUP OP_HASH160 b6fc54e2f7c490ba20c686f532bfb02230656dbf OP_EQUALVERIFY OP_CHECKSIG"}}, {"spentIndex": 0, "spentHeight": 897194, "value": "0.01610436", "n": 1, "spentTxId": "f41cbedd8becee05a830f418d13aa665125464547db5c7a6cd28f21639fe1228", "scriptPubKey": {"type": "scripthash", "hex": "a91463ff81a0110ab929bd1d44befa32b081839bbece87", "addresses": ["2N2MxyAfifVhb3AMagisxaj3uij8bfXqf4Y"], "asm": "OP_HASH160 63ff81a0110ab929bd1d44befa32b081839bbece OP_EQUAL"}}], "blockhash": "00000000007a07f1fe23d089eddd6731fffd2696fed36611c5e0529e5e9c13b9", "valueIn": 0.13541492, "fees": 6.892e-05, "vin": [{"addr": "n1QPb8R2VWL6s2t5HbtDdNX3A7h4QTeCxB", "vout": 1, "sequence": 4294967295, "doubleSpentTxID": null, "value": 0

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_testnet_tx_b0946dc27ba308a749b11afecc2018980af18f79e89ad6b080b58220d856f739.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1726
                                                                                                                                                                                                                      Entropy (8bit):5.256948371351805
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:YSP3d0yQq83yGamVd0yQqV3yGASpGXBVWRT2h2KjZR0mnnyIfCC7:fPdR8emRVcSpGXBkR428ZR08yIh
                                                                                                                                                                                                                      MD5:9B166C7909788282BF8D91BDF7FD996C
                                                                                                                                                                                                                      SHA1:198048794F637317EC778086E7809919C113C8AF
                                                                                                                                                                                                                      SHA-256:1B7A3CDA05CFA1B80D7078580E62F90C2378496C5CBC892302BE7FF88F7D946D
                                                                                                                                                                                                                      SHA-512:AA4A786D41EC7CB4A93BDBCD932A1FFA4665EB560BD4346060949D80A383D5E9032D3FAD6C782032BAAD7D0FF97558900FC3DEA4952E18D4C6EA4EE14910684A
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"txid": "b0946dc27ba308a749b11afecc2018980af18f79e89ad6b080b58220d856f739", "version": 1, "locktime": 0, "vin": [{"txid": "d80c34ee14143a8bf61125102b7ef594118a3796cad670fa8ee15080ae155318", "vout": 1, "sequence": 4294967295, "n": 0, "scriptSig": {"hex": "473044022004b4045313f2b9f20c3d0d7e042c1caf3ee7af0531a4a4359c1f950f9b7780e602205abf837a2fdefd3ee708f052e740e763702bb40e976cab4e243035d4d77cb3b401210228fa17826fb9632c6e36ee31b32aebf20a81ee921b3d1c627a94b4b3dba879dd", "asm": "3044022004b4045313f2b9f20c3d0d7e042c1caf3ee7af0531a4a4359c1f950f9b7780e602205abf837a2fdefd3ee708f052e740e763702bb40e976cab4e243035d4d77cb3b4[ALL] 0228fa17826fb9632c6e36ee31b32aebf20a81ee921b3d1c627a94b4b3dba879dd"}, "addr": "mhu28zovdephvsYqdWicfYnCccTHwC3yfd", "valueSat": 193067531, "value": 1.93067531, "doubleSpentTxID": null}], "vout": [{"value": "0.55500000", "n": 0, "scriptPubKey": {"hex": "a9142880f749ea56a74031c2b222cf88937da6f58a3787", "asm": "OP_HASH160 2880f749ea56a74031c2b222cf88937da6f58a37 OP_EQUAL", "a

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_testnet_tx_c9348040bbc2024e12dcb4a0b4806b0398646b91acf314da028c3f03dd0179fc.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):933
                                                                                                                                                                                                                      Entropy (8bit):4.964094078069092
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:YlT7LT4xVQY9FV4zN43XaRTfF+F8TrKNUnTu0+lwfmk:YlIVQY9FKG3AE8XKWnTilwp
                                                                                                                                                                                                                      MD5:74AB61655D4803ACAD9335E38AC6E997
                                                                                                                                                                                                                      SHA1:2DF647ABDDBBE59A686E6B342776DFAAD0C4A612
                                                                                                                                                                                                                      SHA-256:264143AD4758F5532C828447A0AB9921897072FCB22A95D0DF4A80266A37EB1F
                                                                                                                                                                                                                      SHA-512:C2D352D4A6E183D680EB54E71F2CADAE5D581BE4969746D7C5D6B96820DA3B02289E284F81C36121CB2C8ABCA0E15D304C868F758306EF5ACF59E41289FFF656
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"valueOut": 0.01604, "vout": [{"spentIndex": 0, "spentHeight": 1112862, "value": "0.01604000", "n": 0, "spentTxId": "31bc1c88ce6ae337a6b3057a16d5bad0b561ad1dfc047d0a7fbb8814668f91e5", "scriptPubKey": {"hex": "00201e8dda334f11171190b3da72e526d441491464769679a319a2f011da5ad312a1", "asm": "0 1e8dda334f11171190b3da72e526d441491464769679a319a2f011da5ad312a1"}}], "blockhash": "0000000000000056aebed3be65011aa622d7aecb8d1265f21f58734acce5915f", "valueIn": 0.01605, "fees": 1e-05, "vin": [{"addr": null, "vout": 0, "sequence": 4294967295, "doubleSpentTxID": null, "value": 0.01605, "n": 0, "valueSat": 1605000, "txid": "f41cbedd8becee05a830f418d13aa665125464547db5c7a6cd28f21639fe1228", "scriptSig": {"hex": "", "asm": null}}], "txid": "c9348040bbc2024e12dcb4a0b4806b0398646b91acf314da028c3f03dd0179fc", "blocktime": 1467937587, "version": 1, "confirmations": 224391, "time": 1467937587, "blockheight": 897207, "locktime": 0, "size": 94}

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_testnet_tx_d2dcdaf547ea7f57a713c607f15e883ddc4a98167ee2c43ed953c53cb5153e24.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1466
                                                                                                                                                                                                                      Entropy (8bit):5.306569126167327
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:Y7MZAPgE6uOX99/+YQByi89jiPUlP/dCgLKqOXG6c5hVty+2ZX19qIZ70eW00GzC:YUAubrZhpiP8PFCgWxW1J2dRx0TEJBG
                                                                                                                                                                                                                      MD5:50257146388C4E586B2F15DBA10D47C8
                                                                                                                                                                                                                      SHA1:EB22F05A3CECFDEB6F3B141C74D19009BD567A05
                                                                                                                                                                                                                      SHA-256:012FD6590E8DDA29803E5655C3C52A94DBF18960B3B82AF916A67CBC773A1B14
                                                                                                                                                                                                                      SHA-512:08932B2475372DBBE18947E8E09F6A2819C004E548342A05DBBF18D626469611E943963540D7E9B86A87B2AAC26C0AE2676D44C07C7023069F9135B354A12B37
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"txid": "d2dcdaf547ea7f57a713c607f15e883ddc4a98167ee2c43ed953c53cb5153e24", "version": 1, "locktime": 0, "vin": [{"txid": "4e686d9815219fc2e57baae29c3b44567693b96fbe150550c269786fbbc6d653", "vout": 0, "sequence": 4294967295, "n": 0, "scriptSig": {"hex": "160014e31581ae69eca39192917940e6604fe6546441c0", "asm": "0014e31581ae69eca39192917940e6604fe6546441c0"}, "addr": "2N2Bw4ofaXx79bEdmG556FMGqa2EWmzJKr8", "valueSat": 2870562139, "value": 28.70562139, "doubleSpentTxID": null}], "vout": [{"value": "27.47158341", "n": 0, "scriptPubKey": {"hex": "a914f96f26251d4edd4c915aa76885dc0a91ec83df1087", "asm": "OP_HASH160 f96f26251d4edd4c915aa76885dc0a91ec83df10 OP_EQUAL", "addresses": ["2NFz7PpPg58HExT4stQDFoqpqduKaiwApqu"], "type": "scripthash"}, "spentTxId": "fe26bc077de27b72ffc5ce77a7e296c7c855b7deb3dec72a3f82c0c07c722bb0", "spentIndex": 0, "spentHeight": 1155197}, {"value": "1.23400000", "n": 1, "scriptPubKey": {"hex": "76a9145740ddea127387c6650ab531994fe6a29b0cec3388ac", "asm": "OP_DUP OP_HASH

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_testnet_tx_d6da21677d7cca5f42fbc7631d062c9ae918a0254f7c6c22de8e8cb7fd5b8236.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):871
                                                                                                                                                                                                                      Entropy (8bit):5.2418816855651995
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:YYpsh5BYN+D45fx2ZBI3ovXWpSF1vFxvme+o9qzwJ4:Yp1Fkx2movpvMqIl
                                                                                                                                                                                                                      MD5:721AC0A339013DD99590DD0E83B7B17C
                                                                                                                                                                                                                      SHA1:347342B489BD47384B45580FEA5EBF31934D6431
                                                                                                                                                                                                                      SHA-256:37644FAA0380D03A2FC1B52C3ECF601FF40383AB394C9670A9C747B6FB86F1CB
                                                                                                                                                                                                                      SHA-512:38686F5639FC01118EE0C039CB447913308E38B7EECBCD2860D792C135FCAEB9B286EC9E97E6EBB0908A79E5243EE60932FD16D5BD21236781A801B65A09FBF4
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"valueOut": 25.0027823, "isCoinBase": true, "vout": [{"spentIndex": 0, "spentHeight": 245746, "value": "25.00278230", "n": 0, "spentTxId": "871884776fe6aa078a16b66d82157ab4159257aa2889da9229f4e024ba40d6ee", "scriptPubKey": {"type": "pubkeyhash", "hex": "76a9140223b1a09138753c9cb0baf95a0a62c82711567a88ac", "addresses": ["mfiGQVPcRcaEvQPYDErR34DcCovtxYvUUV"], "asm": "OP_DUP OP_HASH160 0223b1a09138753c9cb0baf95a0a62c82711567a OP_EQUALVERIFY OP_CHECKSIG"}}], "blockhash": "000000000001994ec2997c267bc843d5b24032db26e5e1c56bffaf43c786a339", "vin": [{"coinbase": "0352bf03062f503253482f04f919855308f8000001c7000000092f7374726174756d2f", "n": 0, "sequence": 0}], "txid": "d6da21677d7cca5f42fbc7631d062c9ae918a0254f7c6c22de8e8cb7fd5b8236", "blocktime": 1401231865, "version": 1, "confirmations": 786738, "time": 1401231865, "blockheight": 245586, "locktime": 0, "size": 120}

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_testnet_tx_d80c34ee14143a8bf61125102b7ef594118a3796cad670fa8ee15080ae155318.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1792
                                                                                                                                                                                                                      Entropy (8bit):5.222998041543106
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:Y7MNAr1gE/G06RXlAxUQltAxUQzYFFl2kBsVqIAA5i2Z2j9qINWWJ2I+KgcmHncd:YVNB6veqYdaVRAJ24BDEUxbd
                                                                                                                                                                                                                      MD5:2B9A19BC9A948F04ED95BF338D151BF0
                                                                                                                                                                                                                      SHA1:C7C5C3D72D8C55E9EABFE4E309E08A48686C26EA
                                                                                                                                                                                                                      SHA-256:68B0B150BA33ED7790D56257C135ED60D59F480AF7F587D9D53E9A23E257ABC0
                                                                                                                                                                                                                      SHA-512:7C184E28F548BADBF32286308D50975EAE88EAA3748D0E43488E9852CC037B2196985F7AF6595838D2E93F9E6BB6FCD001800CDBF4AB42627928AE1E1C5CF4BA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"txid": "d80c34ee14143a8bf61125102b7ef594118a3796cad670fa8ee15080ae155318", "version": 1, "locktime": 0, "vin": [{"txid": "16c6c8471b8db7a628f2b2bb86bfeefae1766463ce8692438c7fd3fce3f43ce5", "vout": 0, "sequence": 4294967295, "n": 0, "scriptSig": {"hex": "483045022100ea03d520495cd50b22b9c209f428de32aca2116c06e0fd391cf0a516a0974fff02207424a0742166fb4da9676fbfd09c8b5e7f73bdca72cd1088eb6037863448003d012102fbc883b74248b0207b22d42f591ba562db991494428adaaeb7c819ed3ac0cea9", "asm": "3045022100ea03d520495cd50b22b9c209f428de32aca2116c06e0fd391cf0a516a0974fff02207424a0742166fb4da9676fbfd09c8b5e7f73bdca72cd1088eb6037863448003d[ALL] 02fbc883b74248b0207b22d42f591ba562db991494428adaaeb7c819ed3ac0cea9"}, "addr": "mgJ6qw6qhWex1ePkbnaeTcSad7jca3Dpss", "valueSat": 227568531, "value": 2.27568531, "doubleSpentTxID": null}], "vout": [{"value": "0.34500000", "n": 0, "scriptPubKey": {"hex": "a914daa29c05a2af12752e459dedaee1d78e459c379c87", "asm": "OP_HASH160 daa29c05a2af12752e459dedaee1d78e459c379c OP_EQUAL"

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_testnet_tx_e5040e1bc1ae7667ffb9e5248e90b2fb93cd9150234151ce90e14ab2f5933bcd.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1816
                                                                                                                                                                                                                      Entropy (8bit):5.314516416564221
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:YcLd8oCTRB2Y6aC8i2jo8PYDJT6wJgYjKc4H:TzM2Ovi2jo8PYD/gYjFM
                                                                                                                                                                                                                      MD5:37E46A14D25F98EEF32FE14B837C67E9
                                                                                                                                                                                                                      SHA1:67123509BAD10C39EE51179C8FC678843E606383
                                                                                                                                                                                                                      SHA-256:83C93F48F2D8032F20210B95CE85BAE6B8D8934A0EE4D4ABD1848D30EAB368EF
                                                                                                                                                                                                                      SHA-512:E085412803C4BFB1816F5E9B38C62A3C66DE3A980B2BA298696EDA4321A31D36E327538B770A4DA0710AEBFCB4D143A5596A791CC683331A5A043ADA74CC7385
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"txid": "e5040e1bc1ae7667ffb9e5248e90b2fb93cd9150234151ce90e14ab2f5933bcd", "confirmations": 886416, "vout": [{"spentIndex": null, "spentHeight": null, "n": 0, "value": "0.31000000", "spentTxId": null, "scriptPubKey": {"addresses": ["mvbu1Gdy8SUjTenqerxUaZyYjmveZvt33q"], "asm": "OP_DUP OP_HASH160 a579388225827d9f2fe9014add644487808c695d OP_EQUALVERIFY OP_CHECKSIG", "hex": "76a914a579388225827d9f2fe9014add644487808c695d88ac", "type": "pubkeyhash"}}, {"spentIndex": null, "spentHeight": null, "n": 1, "value": "1.42920000", "spentTxId": null, "scriptPubKey": {"addresses": ["n1hLpUJwuAqRvhYDE3LH6VUEFJAMtTHp8e"], "asm": "OP_DUP OP_HASH160 dd597a4de23945b20a56446ce3a1b6e39cbf351c OP_EQUALVERIFY OP_CHECKSIG", "hex": "76a914dd597a4de23945b20a56446ce3a1b6e39cbf351c88ac", "type": "pubkeyhash"}}], "version": 1, "locktime": 0, "blockhash": "00000000204a06722dd65156b2c941ca4991246ad177f588c48999e50a2b0506", "valueIn": 1.7393, "valueOut": 1.7392, "blocktime": 1424379055, "fees": 0.0001, "time": 1424

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\safetlib\tests\txcache\insight_testnet_tx_f41cbedd8becee05a830f418d13aa665125464547db5c7a6cd28f21639fe1228.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1112
                                                                                                                                                                                                                      Entropy (8bit):4.999595731548949
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:YlTtnT+DpelDBZUCTEQ8TEaH8T4z343q1P+lEp3n:Yl5nTIYvx4Q8Qws3qYle
                                                                                                                                                                                                                      MD5:6C6D1AC0BDF17A8E8C9292D15EE6EEC0
                                                                                                                                                                                                                      SHA1:41E873D4C554DC72A37873E3B34A68B8A87686CB
                                                                                                                                                                                                                      SHA-256:9109BD8F346990FB344E59B2EC5DD52BDA118978C169C93FB8FCBB780C913F1B
                                                                                                                                                                                                                      SHA-512:34C9D7C5BEB5772C1AE7B33948FD2EF2624BD063C535B65C1E90366453FC49FCB588EA3C1C0B06EC4F80CEBBB85C91601219C2E7D214E3CEA06C66010C5374B3
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"valueOut": 0.01605, "vout": [{"spentIndex": 0, "spentHeight": 897207, "value": "0.01605000", "n": 0, "spentTxId": "c9348040bbc2024e12dcb4a0b4806b0398646b91acf314da028c3f03dd0179fc", "scriptPubKey": {"hex": "0020c5f4a0a4ea7c0392efe0a9670a73264cffa90b19107cd8a8e9750ff93c77fdfb", "asm": "0 c5f4a0a4ea7c0392efe0a9670a73264cffa90b19107cd8a8e9750ff93c77fdfb"}}], "blockhash": "00000000000001813ec2fb42915573989417ce2bee539cafedf58294b3d69f43", "valueIn": 0.01610436, "fees": 5.436e-05, "vin": [{"addr": "2N2MxyAfifVhb3AMagisxaj3uij8bfXqf4Y", "vout": 1, "sequence": 4294967295, "doubleSpentTxID": null, "value": 0.01610436, "n": 0, "valueSat": 1610436, "txid": "9c31922be756c06d02167656465c8dc83bb553bf386a3f478ae65b5c021002be", "scriptSig": {"hex": "2200201e8dda334f11171190b3da72e526d441491464769679a319a2f011da5ad312a1", "asm": "00201e8dda334f11171190b3da72e526d441491464769679a319a2f011da5ad312a1"}}], "txid": "f41cbedd8becee05a830f418d13aa665125464547db5c7a6cd28f21639fe1228", "blocktime": 146793075

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\select.pyd

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):27416
                                                                                                                                                                                                                      Entropy (8bit):6.835600420682668
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:+WFXERsAnq2NWow4VILQGR5YiSyvLPxWEa0P+:+xqwWow4VILQGf7SyzPx+
                                                                                                                                                                                                                      MD5:6EBA3E39E61C839818F502BD67BBD672
                                                                                                                                                                                                                      SHA1:CD724D843CA57F6EDBBBE94B3C352769F70AED65
                                                                                                                                                                                                                      SHA-256:C942F16C17687E988434813E50D2FB222C528D0E56CCF2D15B13104676F93FC9
                                                                                                                                                                                                                      SHA-512:8614F4DBF7DF68D66BA611B31135EB35EF5C6D24E1C3F3EC4E8DF67BE75102DA991F26FEA76EF930B686A1ED08AD4A4C5F62CB2BEA4233B26D276FFD3C54FC31
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5$..qE{.qE{.qE{.x=..sE{.#0z.sE{.#0~.zE{.#0..{E{.#0x.sE{..0z.sE{.qEz.LE{.:=z.tE{..0s.pE{..0{.pE{..0..pE{..0y.pE{.RichqE{.........PE..L...H.,d...........!........."...............0......................................u%....@..........................:..L....;..x....`...............<.../...p......D6..T............................6..@............0...............................text............................... ..`.rdata.."....0......................@..@.data........P......................@....rsrc........`.......0..............@..@.reloc.......p.......:..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\sqlite3.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1196824
                                                                                                                                                                                                                      Entropy (8bit):6.776326140308749
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24576:E6OOR2q+dGpg4XzLojJT5r6hKarVTgnEEUNTZOdEV8RpDq+m5:zR2L94Xo5Q5OEeEYDzm5
                                                                                                                                                                                                                      MD5:C60F6C4051EB55350C6EEDF5A87016AA
                                                                                                                                                                                                                      SHA1:DB1C31C12BE04A5785D7CA3B8EA91B290EE9D1D8
                                                                                                                                                                                                                      SHA-256:376D80DB08CEC2C8873A4D5EBC7D83F50F26A43EBAA837020874C8586FD85975
                                                                                                                                                                                                                      SHA-512:FCBDFC27A778B1084BE96B88CF438E0937ADB8BABC41B538892B76283232AA557CE46701A8F62AB2FDB208AB0933F0E473CBD6DAD59203DC7495F48EE289B2A3
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z.............^....L.....L.....L.....L.....U.........................2..........Rich...................PE..L.....,d...........!................_........................................@.......7....@.........................`;..."...].........................../...........5..T........................... 6..@............................................text............................... ..`.rdata...Y.......Z..................@..@.data....'...p..."...Z..............@....rsrc................|..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI68762\unicodedata.pyd

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1114904
                                                                                                                                                                                                                      Entropy (8bit):5.393522969186712
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12288:PAKqQCb5Pfhnzr0qlmL8klMmuZ63NGM7IRG5eeIDe6VZyrIBHdQLhfFE+tc9S:PAKsZV0mmduJMMREtIC6Vo4uLc9S
                                                                                                                                                                                                                      MD5:73A25EF47977BFF82315023F7F8E9DB1
                                                                                                                                                                                                                      SHA1:9BD7882C39A995EA4044FB5D562060C16AF9A023
                                                                                                                                                                                                                      SHA-256:AC2966C1A1F1FBEE97666E0AAADE5AB960B445AF3BACC1650B83EA8B637F2F7A
                                                                                                                                                                                                                      SHA-512:C6155957E37C7A690E815F78508CCDCE9036E2EFFE45A9B47EAAFBB8A091D661B808C1A2CC6C7B83B41752121B869A877C981EE346B790F3CF3900A3D6F0B198
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........#..p..p..p...p..p..q..p..q...p..q..p..q..p..q..p..q..p..p...p..q..p..q..p..tp..p..q..pRich..p........................PE..L...K.,d...........!.....8...........=.......P.......................................X....@.............................X................................/..............T...........................P...@............P..,............................text...J7.......8.................. ..`.rdata...}...P...~...<..............@..@.data...8...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\Desktop\electrum_data\blockchain_headers

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):66447360
                                                                                                                                                                                                                      Entropy (8bit):0.0
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3::
                                                                                                                                                                                                                      MD5:9F48C738FA8DD7FC854D2B2832632E81
                                                                                                                                                                                                                      SHA1:678831DBF820F4454A63077685D4F7B619F12B78
                                                                                                                                                                                                                      SHA-256:6DD0C62ED4B518A6A990C5FF25AE060C6B804317C3A6AC135398ED1D4613C1A4
                                                                                                                                                                                                                      SHA-512:653BD058ED8D30910D580179E7C49F74092F47379BAC262B9C4BFF518C4218919E0042897FF83BDC45509C2127CCE06D2A2A454C63D1325318A874E14B33AA5B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\Desktop\electrum_data\config

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):252
                                                                                                                                                                                                                      Entropy (8bit):4.966594948366621
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:3FFBWLURhvFNGwApr9ApRZvFsheQV+AH6ZFOYyZB1xA:1bW+vdmA0hhV+AH6aYy/HA
                                                                                                                                                                                                                      MD5:9FF816D60B91A830B6DA15C7D7F6ECDD
                                                                                                                                                                                                                      SHA1:FF8DA813F43C9B91387B9FDC1E1E9403D1DAA866
                                                                                                                                                                                                                      SHA-256:5DE3958E6B8FF0F87D7691B17597D820C772EE159A95D257838018C35585B685
                                                                                                                                                                                                                      SHA-512:2C98D9B51265CF91F56AC42EDAFCF7F63CE6BDFE80F4517EC4DD844BD366655D9174B1380C32DF61C5078162705CE7850C1D3D1F374E3EF9F5E033CA10F8CFE7
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{.. "blockchain_preferred_block": {.. "hash": "000000000019d6689c085ae165831e934ff763ae46a2a6c172b3f1b60a8ce26f",.. "height": 0.. },.. "config_version": 3,.. "rpcpassword": "F7s__pgPJzhcKTdvSx7SwA==",.. "rpcuser": "user"..}

                                                                                                                                                                                                                      C:\Users\user\Desktop\electrum_data\daemon

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):49
                                                                                                                                                                                                                      Entropy (8bit):3.9538102933957355
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3:RLVzET1pMTRVOn:nIJpMd8n
                                                                                                                                                                                                                      MD5:757CD68ACC3AAFB0F5D8EA28B7F6B4FA
                                                                                                                                                                                                                      SHA1:E57F993669539AA552F1B71D141329F6EC8CB92A
                                                                                                                                                                                                                      SHA-256:F49746BBFA2A36F61858BF774517E32F617B2665B740959F129ACD0A757E4218
                                                                                                                                                                                                                      SHA-512:5B4072304D8FA00C2AF1C99AE409FFE07D76D360E88E3D5716225A1FA6071E16575ECB89AA0F22D7BFF8D54FE33A4C87C7F04E15910B5B74D633A86BAB3F38F6
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:('tcp', ('127.0.0.1', 49738), 1710427146.8106408)

                                                                                                                                                                                                                      Static File Info

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      File type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                      Entropy (8bit):7.998118698241338
                                                                                                                                                                                                                      TrID:
                                                                                                                                                                                                                      • Win32 Executable (generic) a (10002005/4) 99.53%
                                                                                                                                                                                                                      • InstallShield setup (43055/19) 0.43%
                                                                                                                                                                                                                      • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                                      • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                      File name:SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      File size:47'825'152 bytes
                                                                                                                                                                                                                      MD5:cf15ed86315ab1a94996fb69ef157005
                                                                                                                                                                                                                      SHA1:92dfe7452e0a21e6b5da69f386603080eca9d7eb
                                                                                                                                                                                                                      SHA256:175eb4505659184198a6dacaf5c52bf80c9b10f168b081a07e3457058cc51e89
                                                                                                                                                                                                                      SHA512:446616ddaf2b0c9635d0db45bbb9021589a8782fedab64c0dff910bf35d64fd8bf6a5b05014e608eafec9037470e8a5162002225d47000fb2854c2763125b27f
                                                                                                                                                                                                                      SSDEEP:786432:fF8WWxUd9d1LRphkc3FphiWGlso5EYWAFPMUcgDB2hREoBQkMGIcmdK19diGgETh:fF8WWxU9ddRzFphiZd5EXUcgD4hzIzs3
                                                                                                                                                                                                                      TLSH:CAA733C6CDB20473E421047BACD5FDF1873D52E89BB6842BDA39005766BBCE24A5162F
                                                                                                                                                                                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n05[........../....#.j........................@..........................`.............................................

                                                                                                                                                                                                                      File Icon

                                                                                                                                                                                                                      Icon Hash:2b2d33aaaa232d33

                                                                                                                                                                                                                      Static PE Info

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Entrypoint:0x4014b0
                                                                                                                                                                                                                      Entrypoint Section:.text
                                                                                                                                                                                                                      Digitally signed:true
                                                                                                                                                                                                                      Imagebase:0x400000
                                                                                                                                                                                                                      Subsystem:windows gui
                                                                                                                                                                                                                      Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DEBUG_STRIPPED
                                                                                                                                                                                                                      DLL Characteristics:
                                                                                                                                                                                                                      Time Stamp:0x5B35306E [Thu Jun 28 19:01:02 2018 UTC]
                                                                                                                                                                                                                      TLS Callbacks:0x40d830, 0x40d7e0
                                                                                                                                                                                                                      CLR (.Net) Version:
                                                                                                                                                                                                                      OS Version Major:4
                                                                                                                                                                                                                      OS Version Minor:0
                                                                                                                                                                                                                      File Version Major:4
                                                                                                                                                                                                                      File Version Minor:0
                                                                                                                                                                                                                      Subsystem Version Major:4
                                                                                                                                                                                                                      Subsystem Version Minor:0
                                                                                                                                                                                                                      Import Hash:e9d858bf5cc2b22933333fd98518c716

                                                                                                                                                                                                                      Authenticode Signature

                                                                                                                                                                                                                      Signature Valid:true
                                                                                                                                                                                                                      Signature Issuer:CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
                                                                                                                                                                                                                      Signature Validation Error:The operation completed successfully
                                                                                                                                                                                                                      Error Number:0
                                                                                                                                                                                                                      Not Before, Not After
                                                                                                                                                                                                                      • 11/05/2022 01:00:00 11/05/2024 00:59:59
                                                                                                                                                                                                                      Subject Chain
                                                                                                                                                                                                                      • CN=Electrum Technologies GmbH, O=Electrum Technologies GmbH, L=Berlin, C=DE
                                                                                                                                                                                                                      Version:3
                                                                                                                                                                                                                      Thumbprint MD5:C09ADC61D776FBF71D03B4C85A6966E8
                                                                                                                                                                                                                      Thumbprint SHA-1:780404C800C6398FA80F11DA7F56BDDB94846E45
                                                                                                                                                                                                                      Thumbprint SHA-256:A1DDA05EDB3433066E485DA74445EFEC685F6FDE13CB62BBE2B207A3758C1B1E
                                                                                                                                                                                                                      Serial:0FD8543AF7A221C51CF906165B1CC0E4

                                                                                                                                                                                                                      Entrypoint Preview

                                                                                                                                                                                                                      Instruction
                                                                                                                                                                                                                      mov dword ptr [004302A8h], 00000001h
                                                                                                                                                                                                                      jmp 00007FB23085AE26h
                                                                                                                                                                                                                      nop
                                                                                                                                                                                                                      mov dword ptr [004302A8h], 00000000h
                                                                                                                                                                                                                      jmp 00007FB23085AE16h
                                                                                                                                                                                                                      nop
                                                                                                                                                                                                                      sub esp, 1Ch
                                                                                                                                                                                                                      mov eax, dword ptr [esp+20h]
                                                                                                                                                                                                                      mov dword ptr [esp], eax
                                                                                                                                                                                                                      call 00007FB230870A16h
                                                                                                                                                                                                                      test eax, eax
                                                                                                                                                                                                                      sete al
                                                                                                                                                                                                                      add esp, 1Ch
                                                                                                                                                                                                                      movzx eax, al
                                                                                                                                                                                                                      neg eax
                                                                                                                                                                                                                      ret
                                                                                                                                                                                                                      nop
                                                                                                                                                                                                                      nop
                                                                                                                                                                                                                      nop
                                                                                                                                                                                                                      push ebp
                                                                                                                                                                                                                      mov ebp, esp
                                                                                                                                                                                                                      push edi
                                                                                                                                                                                                                      push esi
                                                                                                                                                                                                                      push ebx
                                                                                                                                                                                                                      sub esp, 1Ch
                                                                                                                                                                                                                      mov dword ptr [esp], 00419000h
                                                                                                                                                                                                                      call dword ptr [00431370h]
                                                                                                                                                                                                                      sub esp, 04h
                                                                                                                                                                                                                      test eax, eax
                                                                                                                                                                                                                      je 00007FB23085B1E5h
                                                                                                                                                                                                                      mov ebx, eax
                                                                                                                                                                                                                      mov dword ptr [esp], 00419000h
                                                                                                                                                                                                                      call dword ptr [00431390h]
                                                                                                                                                                                                                      mov edi, dword ptr [00431378h]
                                                                                                                                                                                                                      sub esp, 04h
                                                                                                                                                                                                                      mov dword ptr [00422028h], eax
                                                                                                                                                                                                                      mov dword ptr [esp+04h], 00419013h
                                                                                                                                                                                                                      mov dword ptr [esp], ebx
                                                                                                                                                                                                                      call edi
                                                                                                                                                                                                                      sub esp, 08h
                                                                                                                                                                                                                      mov esi, eax
                                                                                                                                                                                                                      mov dword ptr [esp+04h], 00419029h
                                                                                                                                                                                                                      mov dword ptr [esp], ebx
                                                                                                                                                                                                                      call edi
                                                                                                                                                                                                                      mov dword ptr [00418004h], eax
                                                                                                                                                                                                                      sub esp, 08h
                                                                                                                                                                                                                      test esi, esi
                                                                                                                                                                                                                      je 00007FB23085B183h
                                                                                                                                                                                                                      mov dword ptr [esp+04h], 0042202Ch
                                                                                                                                                                                                                      mov dword ptr [esp], 0041F000h
                                                                                                                                                                                                                      call esi
                                                                                                                                                                                                                      mov dword ptr [esp], 004015A0h
                                                                                                                                                                                                                      call 00007FB23085B0D3h
                                                                                                                                                                                                                      lea esp, dword ptr [ebp-0Ch]
                                                                                                                                                                                                                      pop ebx
                                                                                                                                                                                                                      pop esi

                                                                                                                                                                                                                      Data Directories

                                                                                                                                                                                                                      NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0x310000x10dc.idata
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0x350000x10148.rsrc
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x2d998980x2868
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_TLS0x1d9e40x18.rdata
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_IAT0x313040x278.idata
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                      Sections

                                                                                                                                                                                                                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                      .text0x10000x168440x16a00bfa94cc0c6fba6cfbec218f12bae7497False0.49559737569060774data6.147093437333147IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                      .data0x180000x7c0x2005f248157483c9031b1f144a8f35a67cdFalse0.158203125data1.0951453424827384IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                      .rdata0x190000x5ab80x5c0056eab60172568da905cfe22d274d8173False0.4833984375data6.423591165273786IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                      /40x1f0000x282c0x2a005ade56e21c5cc0870eed26c14dc73992False0.31156994047619047data4.885403344130252IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                      .bss0x220000xecb40x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                      .idata0x310000x10dc0x12001a0f376f0f1923d8b6ac09985cd92d62False0.3878038194444444PGP symmetric key encrypted data - Plaintext or unencrypted data5.130264530707902IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                      .CRT0x330000x340x2003d6d77b813b142a365114d8d26628b28False0.0703125Matlab v4 mat-file (little endian) \220\327@, numeric, rows 4198704, columns 00.2709192282599745IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                      .tls0x340000x80x200bf619eac0cdf3f68d496ea9344137e8bFalse0.02734375data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                      .rsrc0x350000x110000x102003b12c52c6e1917222adab677428556b6False0.6228197674418605data6.0401874871081915IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                      Resources

                                                                                                                                                                                                                      NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                      RT_ICON0x352080x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 00.38853790613718414
                                                                                                                                                                                                                      RT_ICON0x35ab00x6d06PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9946255822285919
                                                                                                                                                                                                                      RT_ICON0x3c7b80x4228Device independent bitmap graphic, 64 x 128 x 32, image size 00.2696622579121398
                                                                                                                                                                                                                      RT_ICON0x409e00x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 00.34315352697095436
                                                                                                                                                                                                                      RT_ICON0x42f880x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 00.38672607879924953
                                                                                                                                                                                                                      RT_ICON0x440300x6b8Device independent bitmap graphic, 20 x 40 x 32, image size 00.5866279069767442
                                                                                                                                                                                                                      RT_ICON0x446e80x468Device independent bitmap graphic, 16 x 32 x 32, image size 00.5328014184397163
                                                                                                                                                                                                                      RT_GROUP_ICON0x44b500x68data0.7596153846153846
                                                                                                                                                                                                                      RT_MANIFEST0x44bb80x590XML 1.0 document, ASCII text, with CRLF line terminators0.44662921348314605

                                                                                                                                                                                                                      Imports

                                                                                                                                                                                                                      DLLImport
                                                                                                                                                                                                                      ADVAPI32.dllConvertSidToStringSidW, ConvertStringSecurityDescriptorToSecurityDescriptorW, GetTokenInformation, OpenProcessToken
                                                                                                                                                                                                                      COMCTL32.DLLLoadIconMetric
                                                                                                                                                                                                                      GDI32.dllCreateFontIndirectW, DeleteObject, SelectObject
                                                                                                                                                                                                                      KERNEL32.dllCloseHandle, CreateDirectoryW, CreateProcessW, DeleteCriticalSection, EnterCriticalSection, ExpandEnvironmentStringsW, FindClose, FindFirstFileExW, FormatMessageW, FreeLibrary, GetCommandLineW, GetCurrentProcess, GetEnvironmentVariableW, GetExitCodeProcess, GetLastError, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleW, GetProcAddress, GetStartupInfoW, GetTempPathW, InitializeCriticalSection, IsDBCSLeadByteEx, LeaveCriticalSection, LoadLibraryA, LoadLibraryExW, LocalFree, MulDiv, MultiByteToWideChar, SetConsoleCtrlHandler, SetDllDirectoryW, SetEnvironmentVariableW, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualProtect, VirtualQuery, WaitForSingleObject, WideCharToMultiByte
                                                                                                                                                                                                                      msvcrt.dll__argc, __lconv_init, __mb_cur_max, __p__commode, __p__fmode, __p__wcmdln, __set_app_type, __setusermatherr, __wargv, __wgetmainargs, __winitenv, _amsg_exit, _cexit, _errno, _filelengthi64, _fileno, _findclose, _get_osfhandle, _initterm, _iob, _lock, _onexit, _setmode, _snwprintf, fwprintf, _unlock, _wcsdup, _wfopen, _wfullpath, _wputenv_s, _wremove, _wrmdir, _wtempnam, abort, atoi, calloc, clearerr, exit, fclose, feof, ferror, fflush, fgetpos, fprintf, fputc, fputwc, fread, free, fsetpos, fwrite, iswctype, localeconv, malloc, mbstowcs, memcmp, memcpy, memset, perror, realloc, setbuf, setlocale, signal, strcat, strchr, strcmp, strcpy, strerror, strlen, strncat, strncmp, strncpy, strtok, vfprintf, wcscat, wcschr, wcscmp, wcscpy, wcslen, wcsncpy, wcstombs, _wstat, _wfindnext, _wfindfirst, _stat, _wcsdup, _strdup, _getpid, _fileno
                                                                                                                                                                                                                      USER32.dllCreateWindowExW, DestroyIcon, DialogBoxIndirectParamW, DrawTextW, EndDialog, GetClientRect, GetDC, GetDialogBaseUnits, GetWindowLongW, InvalidateRect, MessageBoxA, MessageBoxW, MoveWindow, ReleaseDC, SendMessageW, SetWindowLongW, SystemParametersInfoW

                                                                                                                                                                                                                      Network Behavior

                                                                                                                                                                                                                      ⊘No network behavior found

                                                                                                                                                                                                                      Statistics

                                                                                                                                                                                                                      CPU Usage

                                                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                                                      Memory Usage

                                                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                                                      High Level Behavior Distribution

                                                                                                                                                                                                                      Click to dive into process behavior distribution

                                                                                                                                                                                                                      Behavior

                                                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                                                      System Behavior

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:0
                                                                                                                                                                                                                      Start time:15:38:42
                                                                                                                                                                                                                      Start date:14/03/2024
                                                                                                                                                                                                                      Path:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                      Commandline:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      Imagebase:0x400000
                                                                                                                                                                                                                      File size:47'825'152 bytes
                                                                                                                                                                                                                      MD5 hash:CF15ED86315AB1A94996FB69EF157005
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:2
                                                                                                                                                                                                                      Start time:15:39:00
                                                                                                                                                                                                                      Start date:14/03/2024
                                                                                                                                                                                                                      Path:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                      Commandline:C:\Users\user\Desktop\SecuriteInfo.com.Win32.Patched.29806.7109.exe
                                                                                                                                                                                                                      Imagebase:0x400000
                                                                                                                                                                                                                      File size:47'825'152 bytes
                                                                                                                                                                                                                      MD5 hash:CF15ED86315AB1A94996FB69EF157005
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:3
                                                                                                                                                                                                                      Start time:15:39:03
                                                                                                                                                                                                                      Start date:14/03/2024
                                                                                                                                                                                                                      Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                      Commandline:C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                      Imagebase:0x240000
                                                                                                                                                                                                                      File size:236'544 bytes
                                                                                                                                                                                                                      MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:4
                                                                                                                                                                                                                      Start time:15:39:03
                                                                                                                                                                                                                      Start date:14/03/2024
                                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                      Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:5
                                                                                                                                                                                                                      Start time:15:39:04
                                                                                                                                                                                                                      Start date:14/03/2024
                                                                                                                                                                                                                      Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                      Commandline:C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                      Imagebase:0x240000
                                                                                                                                                                                                                      File size:236'544 bytes
                                                                                                                                                                                                                      MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:6
                                                                                                                                                                                                                      Start time:15:39:04
                                                                                                                                                                                                                      Start date:14/03/2024
                                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                      Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:10
                                                                                                                                                                                                                      Start time:15:39:06
                                                                                                                                                                                                                      Start date:14/03/2024
                                                                                                                                                                                                                      Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                      Commandline:C:\Windows\system32\cmd.exe /c fsutil sparse setflag "C:\Users\user\Desktop\electrum_data\blockchain_headers" 1
                                                                                                                                                                                                                      Imagebase:0x240000
                                                                                                                                                                                                                      File size:236'544 bytes
                                                                                                                                                                                                                      MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:11
                                                                                                                                                                                                                      Start time:15:39:06
                                                                                                                                                                                                                      Start date:14/03/2024
                                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                      Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:12
                                                                                                                                                                                                                      Start time:15:39:06
                                                                                                                                                                                                                      Start date:14/03/2024
                                                                                                                                                                                                                      Path:C:\Windows\SysWOW64\fsutil.exe
                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                      Commandline:fsutil sparse setflag "C:\Users\user\Desktop\electrum_data\blockchain_headers" 1
                                                                                                                                                                                                                      Imagebase:0xd50000
                                                                                                                                                                                                                      File size:167'440 bytes
                                                                                                                                                                                                                      MD5 hash:452CA7574A1B2550CD9FF83DDBE87463
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Reputation:moderate
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      Disassembly

                                                                                                                                                                                                                      Reset < >

                                                                                                                                                                                                                        Execution Graph

                                                                                                                                                                                                                        Execution Coverage:1.7%
                                                                                                                                                                                                                        Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                        Signature Coverage:9.4%
                                                                                                                                                                                                                        Total number of Nodes:1393
                                                                                                                                                                                                                        Total number of Limit Nodes:36
                                                                                                                                                                                                                        execution_graph 19657 404300 19658 40430b 19657->19658 19665 4042d0 19658->19665 19663 4042d0 3 API calls 19664 40436b 19663->19664 19688 40f100 19665->19688 19667 4042f7 19667->19664 19668 40e900 setlocale 19667->19668 19669 40e923 _strdup 19668->19669 19670 40e92d setlocale 19668->19670 19669->19670 19671 40e950 wcstombs realloc wcstombs setlocale free 19670->19671 19672 40e948 19670->19672 19680 404348 19671->19680 19672->19671 19673 40e9c8 mbstowcs 19672->19673 19704 40e630 19673->19704 19676 40ea21 19677 40ea42 19676->19677 19679 40ec55 setlocale free 19676->19679 19678 40ea6e 19677->19678 19681 40ea80 19677->19681 19678->19671 19679->19680 19680->19663 19682 40eae1 wcstombs realloc wcstombs 19681->19682 19687 40eb70 wcstombs 19681->19687 19684 40eb4e setlocale free 19682->19684 19684->19680 19686 40ecc2 19686->19684 19687->19684 19687->19686 19689 40f150 19688->19689 19690 40f119 19688->19690 19692 411040 3 API calls 19689->19692 19695 411040 _errno 19690->19695 19694 40f170 19692->19694 19694->19667 19697 4110e2 19695->19697 19699 40f138 19695->19699 19696 4111a0 fputc 19696->19697 19697->19696 19697->19699 19700 40f340 19697->19700 19699->19667 19701 40f350 19700->19701 19702 40f35f 19701->19702 19703 40f378 fputc 19701->19703 19702->19697 19703->19697 19705 40e63d mbstowcs 19704->19705 19705->19676 19705->19677 19706 407940 19707 40794e 19706->19707 19708 4079a7 GetTempPathW _getpid 19707->19708 19709 40795b 19707->19709 19742 4074c0 19708->19742 19764 407650 19709->19764 19712 407967 19773 4077c0 19712->19773 19713 4079e9 _wtempnam 19745 408d40 19713->19745 19716 40797a 19718 407984 _wputenv_s free 19716->19718 19719 407a8a 19716->19719 19718->19708 19722 407aa0 19718->19722 19720 407ab0 19813 408920 19720->19813 19721 407a08 free 19721->19713 19724 407a15 19721->19724 19808 402ed0 19722->19808 19724->19719 19727 407a50 19724->19727 19728 407a28 19724->19728 19795 408b00 19727->19795 19759 407700 19728->19759 19730 407a42 19731 407ae7 19732 407b0c 19731->19732 19733 407aef 19731->19733 19738 408b00 12 API calls 19732->19738 19736 407700 15 API calls 19733->19736 19740 407aff free 19736->19740 19737 407a3a free 19737->19730 19741 407b28 SetEnvironmentVariableW free 19738->19741 19740->19730 19741->19730 19825 40f180 19742->19825 19744 4074e7 19744->19713 19746 40e630 19745->19746 19747 408d4e GetCurrentProcess OpenProcessToken 19746->19747 19748 408e60 GetTokenInformation 19747->19748 19749 408d96 19747->19749 19751 408ea1 calloc 19748->19751 19752 408e92 GetLastError 19748->19752 19750 408d9c free 19749->19750 19753 408db9 _snwprintf LocalFree ConvertStringSecurityDescriptorToSecurityDescriptorW 19750->19753 19754 408dad FindCloseChangeNotification 19750->19754 19751->19749 19755 408ec3 GetTokenInformation 19751->19755 19752->19749 19752->19751 19756 407a00 19753->19756 19757 408e2c CreateDirectoryW 19753->19757 19754->19753 19755->19750 19758 408eeb ConvertSidToStringSidW 19755->19758 19756->19720 19756->19721 19757->19756 19758->19750 19760 408b00 12 API calls 19759->19760 19761 407722 19760->19761 19762 408b00 12 API calls 19761->19762 19763 407740 _wputenv_s free free 19762->19763 19763->19737 19765 40765b 19764->19765 19766 408b00 12 API calls 19765->19766 19767 407680 GetEnvironmentVariableW 19766->19767 19768 4076b0 ExpandEnvironmentStringsW 19767->19768 19769 40769c 19767->19769 19770 408920 15 API calls 19768->19770 19769->19712 19771 4076e7 19770->19771 19771->19769 19772 4076f0 _strdup 19771->19772 19772->19712 19774 4077ce 19773->19774 19775 408b00 12 API calls 19774->19775 19776 4077ef 19775->19776 19777 40790e 19776->19777 19778 4077f9 ExpandEnvironmentStringsW free 19776->19778 19777->19716 19779 402ed0 12 API calls 19777->19779 19780 407900 19778->19780 19781 407827 19778->19781 19782 4078e2 19779->19782 19783 402ed0 12 API calls 19780->19783 19860 408fa0 wcslen 19781->19860 19782->19716 19783->19777 19786 4078f0 _wcsdup 19788 407852 19786->19788 19787 407837 _wfullpath 19787->19788 19789 40785a wcschr 19788->19789 19790 40792e 19788->19790 19792 4078d2 CreateDirectoryW 19789->19792 19793 407888 19789->19793 19791 402ed0 12 API calls 19790->19791 19791->19782 19792->19782 19794 407890 wcsncpy CreateDirectoryW wcschr 19793->19794 19794->19792 19794->19794 19796 408b60 MultiByteToWideChar 19795->19796 19797 408b13 19795->19797 19798 408bf8 19796->19798 19799 408b9c calloc 19796->19799 19800 408b1d MultiByteToWideChar 19797->19800 19803 402f90 9 API calls 19798->19803 19799->19800 19802 408bb9 19799->19802 19801 408bd8 19800->19801 19806 407a6c SetEnvironmentVariableW free 19800->19806 19805 402f90 9 API calls 19801->19805 19863 402f90 GetLastError 19802->19863 19803->19806 19805->19806 19806->19719 19809 40f100 3 API calls 19808->19809 19810 402f01 19809->19810 19811 402df0 12 API calls 19810->19811 19812 402f19 19811->19812 19812->19730 19814 408990 WideCharToMultiByte 19813->19814 19815 408933 19813->19815 19817 408a38 19814->19817 19818 4089dc calloc 19814->19818 19816 40893d WideCharToMultiByte 19815->19816 19820 408a18 19816->19820 19821 407ad0 free 19816->19821 19819 402f90 12 API calls 19817->19819 19818->19816 19822 4089f9 19818->19822 19819->19821 19824 402f90 12 API calls 19820->19824 19821->19730 19821->19731 19823 402f90 12 API calls 19822->19823 19823->19821 19824->19821 19826 40f1d0 19825->19826 19827 40f199 19825->19827 19829 4137e0 7 API calls 19826->19829 19832 4137e0 _errno 19827->19832 19831 40f1f0 19829->19831 19831->19744 19833 413868 19832->19833 19841 40f1b8 19832->19841 19834 413899 19833->19834 19835 4138d0 19833->19835 19834->19841 19842 411e60 19834->19842 19836 411e60 6 API calls 19835->19836 19840 4138f6 19835->19840 19836->19840 19838 411e60 6 API calls 19839 4140f3 19838->19839 19839->19839 19840->19838 19840->19841 19841->19744 19843 411e74 19842->19843 19844 411f90 19843->19844 19849 411e93 19843->19849 19845 411fe3 fwprintf 19844->19845 19846 411f96 19844->19846 19850 411ea2 19845->19850 19847 411fa7 fwprintf 19846->19847 19848 411ffd fwprintf 19846->19848 19847->19850 19848->19850 19852 411e97 19849->19852 19856 4119e0 19849->19856 19850->19841 19852->19850 19853 411eed fputwc 19852->19853 19854 411f40 19852->19854 19853->19852 19854->19850 19855 411f76 fputwc 19854->19855 19855->19854 19857 4119f1 19856->19857 19858 411a00 19857->19858 19859 411a18 fputwc 19857->19859 19858->19849 19859->19849 19861 408fc8 iswctype 19860->19861 19862 40782f 19860->19862 19861->19862 19862->19786 19862->19787 19864 40f100 3 API calls 19863->19864 19865 402fcd 19864->19865 19872 4086f0 19865->19872 19867 402fd9 19884 402dc0 19867->19884 19871 40301c 19871->19806 19873 4086fb 19872->19873 19874 4087d0 GetLastError 19873->19874 19875 40870c FormatMessageW 19873->19875 19874->19875 19876 4087a8 19875->19876 19877 40874c WideCharToMultiByte 19875->19877 19880 402f90 9 API calls 19876->19880 19878 4087e0 19877->19878 19879 40879b 19877->19879 19882 402f90 9 API calls 19878->19882 19879->19867 19881 4087bc 19880->19881 19881->19867 19883 4087f4 19882->19883 19883->19867 19885 40f100 3 API calls 19884->19885 19886 402de7 19885->19886 19887 402df0 19886->19887 19888 402dfc 19887->19888 19889 408b00 10 API calls 19888->19889 19890 402e38 19889->19890 19891 402e90 MessageBoxA 19890->19891 19892 402e3c 19890->19892 19891->19871 19893 408b00 10 API calls 19892->19893 19894 402e5e MessageBoxW 19893->19894 19894->19871 19895 401e60 19896 402020 19895->19896 19897 401e75 19895->19897 19938 4046b0 19896->19938 19910 402014 19897->19910 19924 408550 malloc 19897->19924 19900 401eaa 19900->19910 19935 40ef60 19900->19935 19903 401ed4 fread 19906 402061 19903->19906 19907 401efd 19903->19907 19904 40208f 19905 403030 14 API calls 19904->19905 19905->19910 19908 403030 14 API calls 19906->19908 19909 40ef60 6 API calls 19907->19909 19908->19910 19911 401f57 malloc 19909->19911 19912 4020a5 19911->19912 19913 401f6d fread 19911->19913 19916 403030 14 API calls 19912->19916 19914 402046 19913->19914 19915 401f8f ferror 19913->19915 19944 403030 19914->19944 19918 40207c 19915->19918 19921 401fac 19915->19921 19916->19910 19919 402ed0 12 API calls 19918->19919 19919->19910 19920 401ff6 19920->19910 19922 402006 fclose 19920->19922 19921->19920 19923 402ed0 12 API calls 19921->19923 19922->19910 19923->19921 19925 408571 19924->19925 19934 4086b2 free 19924->19934 19926 40ef60 6 API calls 19925->19926 19928 40858d 19926->19928 19928->19934 19951 40f050 19928->19951 19930 40ef60 6 API calls 19932 4085a1 19930->19932 19931 40863f fread 19931->19932 19931->19934 19932->19930 19932->19931 19933 408670 memcmp 19932->19933 19932->19934 19933->19932 19933->19934 19934->19900 19956 40ef90 19935->19956 19939 4046bc 19938->19939 19940 408b00 12 API calls 19939->19940 19941 4046e1 19940->19941 19942 408b00 12 API calls 19941->19942 19943 4046fc _wfopen 19942->19943 19943->19897 19945 40f100 3 API calls 19944->19945 19946 403064 _errno strerror 19945->19946 19947 402dc0 3 API calls 19946->19947 19948 4030a3 19947->19948 19949 402df0 12 API calls 19948->19949 19950 4030bb 19949->19950 19950->19910 19954 40f070 fgetpos 19951->19954 19955 40f05f 19954->19955 19955->19932 19957 40efd8 fgetpos 19956->19957 19958 40efac 19956->19958 19959 401ecc 19957->19959 19960 40efec 19957->19960 19961 40f000 fflush _fileno _filelengthi64 19958->19961 19962 40efb1 19958->19962 19959->19903 19959->19904 19960->19961 19963 40efc1 fsetpos 19960->19963 19961->19963 19964 40efb5 19962->19964 19965 40f02a _errno 19962->19965 19963->19959 19964->19963 19965->19959 19966 4066e0 calloc 19967 4066fb 19966->19967 19968 4066ff 19966->19968 19969 403030 14 API calls 19968->19969 19969->19967 19970 401124 __wgetmainargs 19971 401de6 19972 401df0 19971->19972 19973 403030 14 API calls 19972->19973 19974 401d46 19973->19974 19975 401d5c fclose 19974->19975 19976 401d4d fclose 19974->19976 19977 401d68 19975->19977 19976->19975 19978 408668 19979 408670 memcmp 19978->19979 19981 4086b2 free 19979->19981 19984 4085d6 19979->19984 19982 40ef60 6 API calls 19982->19984 19983 40863f fread 19983->19981 19983->19984 19984->19979 19984->19981 19984->19982 19984->19983 19985 407dd0 19986 407dde 19985->19986 20015 4074f0 19986->20015 19989 407f05 19990 4074f0 3 API calls 19991 407e3c 19990->19991 19991->19989 19992 407e47 strlen strtok 19991->19992 19993 407f18 19992->19993 20014 407e6b 19992->20014 19994 408b00 12 API calls 19993->19994 19996 407f33 _wstat 19994->19996 19995 407e78 strlen 19995->19989 19997 407e8c strlen strcpy strtok 19995->19997 19998 407f67 19996->19998 19999 407f48 19996->19999 19997->19993 20000 407ec2 19997->20000 20002 4046b0 13 API calls 19998->20002 20001 407f53 19999->20001 20008 407650 18 API calls 19999->20008 20003 408b00 12 API calls 20000->20003 20004 407ef5 20001->20004 20005 407f57 20001->20005 20006 407f77 20002->20006 20007 407ed6 _wstat 20003->20007 20018 402f30 20004->20018 20010 402f30 12 API calls 20005->20010 20007->19995 20007->20014 20012 407f8e 20008->20012 20010->19998 20011 408d40 13 API calls 20011->20014 20012->20005 20013 407f9e free 20012->20013 20013->20001 20014->19995 20014->20011 20016 40f100 3 API calls 20015->20016 20017 407517 20016->20017 20017->19989 20017->19990 20019 40f100 3 API calls 20018->20019 20020 402f61 20019->20020 20021 402df0 12 API calls 20020->20021 20022 402f79 20021->20022 20022->19989 20023 40a090 20024 40a150 malloc 20023->20024 20025 40a0a9 20023->20025 20024->20025 20026 40a0f0 20024->20026 20027 40a100 memcpy 20025->20027 20028 40a0cf memcpy 20025->20028 20026->20027 20030 40a140 20026->20030 20027->20026 20029 40a190 memcpy 20027->20029 20028->20026 20031 408190 20032 40819e 20031->20032 20033 408b00 12 API calls 20032->20033 20034 4081cc SetConsoleCtrlHandler GetStartupInfoW 20033->20034 20035 40824b _fileno _get_osfhandle 20034->20035 20036 408274 _fileno _get_osfhandle 20035->20036 20037 408297 _fileno _get_osfhandle GetCommandLineW CreateProcessW 20036->20037 20038 408350 20037->20038 20039 40830e WaitForSingleObject GetExitCodeProcess 20037->20039 20040 402f90 12 API calls 20038->20040 20041 408364 20040->20041 20042 40a4b1 20043 40a436 malloc 20042->20043 20045 40a45c 20043->20045 20046 4011b3 20047 4011b8 20046->20047 20048 4011c0 Sleep 20047->20048 20053 4011ea 20047->20053 20049 4011cc 20048->20049 20049->20047 20059 4011da 20049->20059 20050 401406 _amsg_exit 20051 401420 _initterm 20050->20051 20050->20053 20051->20053 20052 401478 _initterm 20054 40149b 20052->20054 20053->20050 20053->20051 20053->20052 20053->20059 20056 4014a3 exit 20054->20056 20057 401241 SetUnhandledExceptionFilter 20057->20059 20058 401267 __p__wcmdln 20058->20059 20059->20050 20059->20053 20059->20058 20060 4012eb malloc 20059->20060 20061 4012e6 20059->20061 20072 40db40 20059->20072 20060->20054 20062 401311 malloc memcpy 20060->20062 20061->20060 20064 40136f 20062->20064 20084 40d770 20064->20084 20066 401388 20089 40d7a0 20066->20089 20069 4013c2 20070 4013d0 20069->20070 20071 401462 _cexit 20069->20071 20073 40db60 20072->20073 20083 40db53 20072->20083 20074 40dd9f 20073->20074 20077 40dd00 20073->20077 20080 40dccd 20073->20080 20081 40d9e0 11 API calls 20073->20081 20073->20083 20092 40d980 20073->20092 20076 40d980 11 API calls 20074->20076 20078 40ddb9 20076->20078 20077->20080 20077->20083 20118 40d9e0 20077->20118 20078->20057 20082 40dd72 VirtualProtect 20080->20082 20080->20083 20081->20073 20082->20080 20083->20057 20085 40d779 20084->20085 20086 40d710 20084->20086 20085->20066 20086->20086 20142 4014d0 _onexit 20086->20142 20088 40d740 20088->20066 20143 4015d0 20089->20143 20140 4173a0 20092->20140 20094 40d994 fwrite 20141 4173a0 20094->20141 20096 40d9c0 vfprintf abort 20097 40d9e0 20096->20097 20098 40db27 20097->20098 20100 40da4b VirtualQuery 20097->20100 20102 40da90 20097->20102 20104 40daa0 VirtualProtect 20097->20104 20099 40d980 4 API calls 20098->20099 20113 40db37 20099->20113 20100->20097 20101 40db07 20100->20101 20101->20098 20103 40d980 4 API calls 20101->20103 20102->20073 20103->20098 20104->20102 20105 40dae0 GetLastError 20104->20105 20106 40d980 4 API calls 20105->20106 20106->20097 20107 40dd9f 20110 40d980 4 API calls 20107->20110 20108 40dd00 20109 40d9e0 4 API calls 20108->20109 20115 40dccd 20108->20115 20117 40db53 20108->20117 20109->20108 20111 40ddb9 20110->20111 20111->20073 20112 40d9e0 VirtualQuery VirtualProtect GetLastError VirtualProtect 20112->20113 20113->20107 20113->20108 20113->20112 20114 40d980 4 API calls 20113->20114 20113->20115 20113->20117 20114->20113 20116 40dd72 VirtualProtect 20115->20116 20115->20117 20116->20115 20117->20073 20124 40d9f6 20118->20124 20119 40da90 20119->20077 20120 40db27 20121 40d980 7 API calls 20120->20121 20134 40db37 20121->20134 20122 40da4b VirtualQuery 20123 40db07 20122->20123 20122->20124 20123->20120 20125 40d980 7 API calls 20123->20125 20124->20119 20124->20120 20124->20122 20126 40daa0 VirtualProtect 20124->20126 20125->20120 20126->20119 20127 40dae0 GetLastError 20126->20127 20128 40d980 7 API calls 20127->20128 20128->20124 20129 40dd9f 20132 40d980 7 API calls 20129->20132 20130 40dd00 20131 40d9e0 7 API calls 20130->20131 20136 40dccd 20130->20136 20139 40db53 20130->20139 20131->20130 20133 40ddb9 20132->20133 20133->20077 20134->20129 20134->20130 20135 40d980 7 API calls 20134->20135 20134->20136 20137 40d9e0 7 API calls 20134->20137 20134->20139 20135->20134 20138 40dd72 VirtualProtect 20136->20138 20136->20139 20137->20134 20138->20136 20139->20077 20140->20094 20141->20096 20142->20088 20148 408a60 calloc 20143->20148 20145 4015ed 20156 403d60 20145->20156 20147 4013af 20147->20056 20147->20069 20149 408adb 20148->20149 20152 408a88 20148->20152 20149->20145 20150 408ae8 20150->20145 20151 408920 15 API calls 20151->20152 20152->20150 20152->20151 20153 408ab9 20152->20153 20154 408ac0 free 20153->20154 20154->20154 20155 408ad1 free 20154->20155 20155->20149 20157 403d6e 20156->20157 20248 4021e0 calloc 20157->20248 20161 404242 fclose 20247 403ecc 20161->20247 20162 403da0 20162->20247 20263 404670 strcpy strlen 20162->20263 20163 402ed0 12 API calls 20163->20247 20166 403dbb 20167 407650 18 API calls 20166->20167 20166->20247 20169 403dea 20167->20169 20168 404190 20385 402220 20168->20385 20172 403f70 20169->20172 20173 403df4 20169->20173 20176 407770 14 API calls 20172->20176 20175 407650 18 API calls 20173->20175 20178 403e00 20175->20178 20179 403f7c 20176->20179 20177 403ed4 strcmp 20180 403f2d 20177->20180 20177->20247 20181 403e37 20178->20181 20185 4041a8 20178->20185 20186 403e18 free 20178->20186 20183 4020d0 51 API calls 20179->20183 20294 403cb0 20180->20294 20187 407770 14 API calls 20181->20187 20188 403f8c 20183->20188 20192 403740 12 API calls 20185->20192 20264 407770 20186->20264 20190 403e43 20187->20190 20188->20185 20191 403f94 20188->20191 20267 4020d0 20190->20267 20196 4020d0 51 API calls 20191->20196 20239 404076 20192->20239 20193 403f11 strcpy 20193->20180 20200 403fab 20196->20200 20197 403f3d 20303 406870 20197->20303 20199 407700 15 API calls 20199->20247 20201 403fe0 20200->20201 20202 403faf 20200->20202 20208 4046b0 13 API calls 20201->20208 20207 402ed0 12 API calls 20202->20207 20203 40407e 20210 4066e0 15 API calls 20203->20210 20204 4041e2 20214 408b00 12 API calls 20204->20214 20205 403e5b 20206 408b00 12 API calls 20205->20206 20211 403e90 20206->20211 20212 403fcf 20207->20212 20213 403ff0 20208->20213 20209 4020d0 51 API calls 20215 4042bc 20209->20215 20216 403eb0 20210->20216 20219 404229 20211->20219 20220 403e9f SetDllDirectoryW 20211->20220 20212->20147 20224 408550 11 API calls 20213->20224 20213->20247 20221 404205 20214->20221 20215->20202 20215->20205 20232 403ec0 20216->20232 20313 4061b0 20216->20313 20227 402ed0 12 API calls 20219->20227 20278 4066e0 calloc 20220->20278 20221->20219 20225 404209 SetDllDirectoryW 20221->20225 20222 406720 4 API calls 20228 403f5f 20222->20228 20229 404048 20224->20229 20230 4066e0 15 API calls 20225->20230 20227->20247 20228->20147 20229->20161 20309 403740 20229->20309 20230->20216 20231 4040a4 20231->20232 20234 4040ac 20231->20234 20232->20247 20282 406720 20232->20282 20328 406410 20234->20328 20238 406870 FreeLibrary 20238->20247 20239->20203 20239->20204 20240 4040bc 20241 4040cc 20240->20241 20356 406670 20240->20356 20243 406870 FreeLibrary 20241->20243 20241->20247 20245 4040e0 20243->20245 20244 406720 4 API calls 20244->20247 20246 406720 4 API calls 20245->20246 20246->20247 20247->20161 20247->20163 20247->20168 20247->20177 20247->20193 20247->20199 20247->20238 20247->20244 20291 403d30 20247->20291 20366 4037a0 20247->20366 20374 408190 20247->20374 20391 407bc0 20247->20391 20403 406980 20247->20403 20249 4021fb 20248->20249 20250 4021ff 20248->20250 20249->20247 20252 4045d0 20249->20252 20251 403030 14 API calls 20250->20251 20251->20249 20253 40e630 20252->20253 20254 4045db GetModuleFileNameW 20253->20254 20255 404630 20254->20255 20256 404601 20254->20256 20257 402f90 12 API calls 20255->20257 20258 408920 15 API calls 20256->20258 20259 404644 20257->20259 20260 40461c 20258->20260 20259->20162 20261 404627 20260->20261 20262 402ed0 12 API calls 20260->20262 20261->20162 20262->20261 20263->20166 20265 408b00 12 API calls 20264->20265 20266 407791 SetEnvironmentVariableW free 20265->20266 20266->20181 20409 401950 20267->20409 20270 402104 20270->20205 20270->20209 20271 401950 3 API calls 20272 402136 20271->20272 20272->20270 20412 404300 20272->20412 20277 402184 fclose 20277->20270 20279 4066fb 20278->20279 20280 4066ff 20278->20280 20279->20216 20281 403030 14 API calls 20280->20281 20281->20279 20283 40676d 20282->20283 20284 40672f 20282->20284 20283->20247 20285 406741 20284->20285 20286 406739 free 20284->20286 20287 406753 20285->20287 20288 40674b free 20285->20288 20286->20285 20289 406765 free 20287->20289 20290 40675d free 20287->20290 20288->20287 20289->20283 20290->20289 20292 40f100 3 API calls 20291->20292 20293 403d57 20292->20293 20293->20247 20449 4056b0 20294->20449 20302 403cee 20302->20197 20304 406881 20303->20304 20308 403f53 20303->20308 20305 40691e 20304->20305 20304->20308 20806 408160 FreeLibrary 20304->20806 20305->20308 20807 408160 FreeLibrary 20305->20807 20308->20222 20310 403760 20309->20310 20311 403756 20309->20311 20310->20311 20312 401980 12 API calls 20310->20312 20311->20239 20312->20310 20314 406360 20313->20314 20315 4061d3 strncpy strncpy strncpy 20313->20315 20317 406368 20314->20317 20318 406387 20314->20318 20322 401980 12 API calls 20314->20322 20316 4043b0 7 API calls 20315->20316 20319 406243 calloc malloc malloc 20316->20319 20317->20231 20320 4019c0 35 API calls 20318->20320 20321 4062c7 20319->20321 20325 40638c 20319->20325 20320->20325 20324 4062d3 memcpy memcpy memcpy 20321->20324 20321->20325 20322->20314 20323 402ed0 12 API calls 20323->20317 20326 406340 free 20324->20326 20327 40632c 20324->20327 20325->20317 20325->20323 20326->20231 20327->20231 20329 40e630 20328->20329 20330 40641e calloc 20329->20330 20331 406640 strncpy 20330->20331 20351 40644d 20330->20351 20332 4065a0 strncpy 20331->20332 20333 4043b0 7 API calls 20332->20333 20335 4065d7 strncpy 20333->20335 20337 4043b0 7 API calls 20335->20337 20336 406470 memcpy 20340 4043b0 7 API calls 20336->20340 20341 4065fb 20337->20341 20338 406534 20342 402ed0 12 API calls 20338->20342 20339 4064e9 strlen 20345 406568 20339->20345 20339->20351 20343 4064a1 strlen strlen 20340->20343 20849 404380 20341->20849 20346 406549 free 20342->20346 20808 401bd0 20343->20808 20345->20331 20347 406577 20345->20347 20346->20240 20350 4043b0 7 API calls 20347->20350 20349 406607 20352 4043b0 7 API calls 20349->20352 20350->20332 20351->20336 20351->20338 20351->20339 20354 406620 20351->20354 20844 402310 20351->20844 20353 406619 20352->20353 20353->20346 20355 402ed0 12 API calls 20354->20355 20355->20353 20357 408100 14 API calls 20356->20357 20358 406683 20357->20358 20359 408100 14 API calls 20358->20359 20360 406697 20359->20360 20361 4066c0 20360->20361 20362 4066ab 20360->20362 20363 402ed0 12 API calls 20361->20363 20950 406d50 GetProcAddress 20362->20950 20365 4066b7 20363->20365 20365->20241 20367 4037d0 20366->20367 20368 4037d8 20366->20368 20367->20247 20369 401bd0 101 API calls 20368->20369 20371 401980 12 API calls 20368->20371 20372 403822 20368->20372 21044 403370 20368->21044 20369->20368 20371->20368 20372->20367 20373 402220 2 API calls 20372->20373 20373->20372 20375 40819e 20374->20375 20376 408b00 12 API calls 20375->20376 20377 4081cc SetConsoleCtrlHandler GetStartupInfoW 20376->20377 20378 40824b _fileno _get_osfhandle 20377->20378 20379 408274 _fileno _get_osfhandle 20378->20379 20380 408297 _fileno _get_osfhandle GetCommandLineW CreateProcessW 20379->20380 20381 408350 20380->20381 20382 40830e WaitForSingleObject GetExitCodeProcess 20380->20382 20383 402f90 12 API calls 20381->20383 20382->20247 20384 408364 20383->20384 20384->20247 20386 402249 20385->20386 20387 40222c 20385->20387 20386->20147 20388 402233 free 20387->20388 20389 40223b 20387->20389 20388->20389 20389->20386 20390 402241 fclose 20389->20390 20390->20386 20392 407bce 20391->20392 20393 408b00 12 API calls 20392->20393 20394 407bf9 wcscpy wcslen 20393->20394 20395 407c24 20394->20395 20396 407c2e wcscat _wfindfirst 20394->20396 20395->20396 20397 407cd0 wcscat 20395->20397 20398 407c80 20396->20398 20399 407c5e _wrmdir 20396->20399 20397->20396 21145 407cf0 20398->21145 20399->20247 20402 407cb8 _findclose 20402->20399 20404 406996 20403->20404 20405 402ed0 12 API calls 20404->20405 20408 4069ed 20404->20408 20406 406a5e 20405->20406 20407 406870 FreeLibrary 20406->20407 20407->20408 20408->20247 20410 40f100 3 API calls 20409->20410 20411 401977 20410->20411 20411->20270 20411->20271 20413 40430b 20412->20413 20414 4042d0 3 API calls 20413->20414 20415 404334 20414->20415 20416 40e900 18 API calls 20415->20416 20419 40214f strcpy 20415->20419 20417 404348 20416->20417 20418 4042d0 3 API calls 20417->20418 20418->20419 20420 401e60 20419->20420 20421 402020 20420->20421 20422 401e75 20420->20422 20424 4046b0 13 API calls 20421->20424 20423 408550 11 API calls 20422->20423 20435 402014 20422->20435 20425 401eaa 20423->20425 20424->20422 20426 40ef60 6 API calls 20425->20426 20425->20435 20427 401ecc 20426->20427 20428 401ed4 fread 20427->20428 20429 40208f 20427->20429 20431 402061 20428->20431 20432 401efd 20428->20432 20430 403030 14 API calls 20429->20430 20430->20435 20433 403030 14 API calls 20431->20433 20434 40ef60 6 API calls 20432->20434 20433->20435 20436 401f57 malloc 20434->20436 20435->20270 20435->20277 20437 4020a5 20436->20437 20438 401f6d fread 20436->20438 20441 403030 14 API calls 20437->20441 20439 402046 20438->20439 20440 401f8f ferror 20438->20440 20442 403030 14 API calls 20439->20442 20443 40207c 20440->20443 20446 401fac 20440->20446 20441->20435 20442->20435 20444 402ed0 12 API calls 20443->20444 20444->20435 20445 401ff6 20445->20435 20447 402006 fclose 20445->20447 20446->20445 20448 402ed0 12 API calls 20446->20448 20447->20435 20448->20446 20450 4056be 20449->20450 20527 405430 20450->20527 20453 4056f3 20457 4043b0 7 API calls 20453->20457 20473 405701 20453->20473 20454 4057ca 20455 402ed0 12 API calls 20454->20455 20474 403cc0 20455->20474 20459 40576a 20457->20459 20458 405717 20460 40571b 20458->20460 20462 402ed0 12 API calls 20458->20462 20461 40576e 20459->20461 20464 402ed0 12 API calls 20459->20464 20538 408100 20460->20538 20708 4044f0 20461->20708 20462->20460 20464->20461 20466 405723 20468 4057f0 20466->20468 20469 40572b 20466->20469 20467 405776 20472 408100 14 API calls 20467->20472 20467->20473 20471 402f90 12 API calls 20468->20471 20541 404760 GetProcAddress 20469->20541 20471->20474 20472->20473 20530 4043b0 20473->20530 20474->20302 20475 405a60 20474->20475 20476 407650 18 API calls 20475->20476 20478 405a75 20476->20478 20477 405a94 20479 408b00 12 API calls 20477->20479 20478->20477 20481 402f30 12 API calls 20478->20481 20480 405ad7 20479->20480 20482 405ca2 20480->20482 20483 405adf 20480->20483 20481->20477 20484 402ed0 12 API calls 20482->20484 20485 408b00 12 API calls 20483->20485 20490 403cd6 20484->20490 20486 405b0a 20485->20486 20487 405ccb 20486->20487 20489 405b12 20486->20489 20488 402ed0 12 API calls 20487->20488 20488->20490 20491 405430 3 API calls 20489->20491 20490->20302 20512 405cf0 strlen 20490->20512 20492 405b77 20491->20492 20493 405c78 20492->20493 20494 405b8a 20492->20494 20495 402ed0 12 API calls 20493->20495 20496 408b00 12 API calls 20494->20496 20495->20490 20497 405b9e 20496->20497 20498 405cb5 20497->20498 20499 405ba6 20497->20499 20500 402ed0 12 API calls 20498->20500 20712 405490 20499->20712 20500->20490 20502 405bc0 20727 408c20 calloc 20502->20727 20504 405beb 20505 405bf5 20504->20505 20506 405c8f 20504->20506 20508 405c31 free 20505->20508 20509 405c20 free 20505->20509 20507 402ed0 12 API calls 20506->20507 20507->20490 20510 405c3f 20508->20510 20509->20508 20509->20509 20510->20490 20511 402ed0 12 API calls 20510->20511 20511->20490 20513 405d26 20512->20513 20514 405dea 20513->20514 20517 405d2e 20513->20517 20515 402ed0 12 API calls 20514->20515 20516 403ce2 20515->20516 20516->20302 20522 405ed0 20516->20522 20517->20516 20519 401980 12 API calls 20517->20519 20520 402ed0 12 API calls 20517->20520 20521 405dba free 20517->20521 20740 4019c0 20517->20740 20519->20517 20520->20517 20521->20517 20523 405ee1 20522->20523 20524 405ee8 20522->20524 20523->20302 20524->20523 20526 401980 12 API calls 20524->20526 20798 405e00 strlen 20524->20798 20526->20524 20528 40f100 3 API calls 20527->20528 20529 405457 20528->20529 20529->20453 20529->20454 20531 4042d0 3 API calls 20530->20531 20532 4043de 20531->20532 20533 404450 20532->20533 20534 4043fa strlen 20532->20534 20533->20458 20534->20533 20535 40440d 20534->20535 20536 404430 strncat strlen 20535->20536 20537 40441f strncat 20535->20537 20536->20458 20537->20458 20539 408b00 12 API calls 20538->20539 20540 408121 LoadLibraryExW free 20539->20540 20540->20466 20542 404e16 20541->20542 20543 40478c GetProcAddress 20541->20543 20546 402f90 12 API calls 20542->20546 20544 4047a9 GetProcAddress 20543->20544 20545 404dfb 20543->20545 20548 404de0 20544->20548 20549 4047c6 GetProcAddress 20544->20549 20547 402f90 12 API calls 20545->20547 20567 404d9b 20546->20567 20547->20567 20550 402f90 12 API calls 20548->20550 20551 4047e3 GetProcAddress 20549->20551 20552 404eac 20549->20552 20550->20567 20554 404800 GetProcAddress 20551->20554 20555 404e8e 20551->20555 20553 402f90 12 API calls 20552->20553 20553->20567 20557 404e70 20554->20557 20558 40481d GetProcAddress 20554->20558 20556 402f90 12 API calls 20555->20556 20556->20567 20559 402f90 12 API calls 20557->20559 20560 404e52 20558->20560 20561 40483a GetProcAddress 20558->20561 20559->20567 20562 402f90 12 API calls 20560->20562 20563 404e34 20561->20563 20564 404857 GetProcAddress 20561->20564 20562->20567 20568 402f90 12 API calls 20563->20568 20565 4053f2 20564->20565 20566 404874 20564->20566 20569 402f90 12 API calls 20565->20569 20570 404882 GetProcAddress 20566->20570 20571 404da8 GetProcAddress 20566->20571 20567->20474 20568->20567 20569->20567 20572 404f24 20570->20572 20573 40489f GetProcAddress 20570->20573 20571->20570 20574 404dc5 20571->20574 20577 402f90 12 API calls 20572->20577 20575 404f06 20573->20575 20576 4048bc GetProcAddress 20573->20576 20578 402f90 12 API calls 20574->20578 20579 402f90 12 API calls 20575->20579 20580 404ee8 20576->20580 20581 4048d9 GetProcAddress 20576->20581 20577->20567 20578->20567 20579->20567 20582 402f90 12 API calls 20580->20582 20583 4048f6 GetProcAddress 20581->20583 20584 404eca 20581->20584 20582->20567 20585 404913 GetProcAddress 20583->20585 20586 404f9c 20583->20586 20587 402f90 12 API calls 20584->20587 20589 404930 GetProcAddress 20585->20589 20590 404f7e 20585->20590 20588 402f90 12 API calls 20586->20588 20587->20567 20588->20567 20591 404f60 20589->20591 20592 40494d GetProcAddress 20589->20592 20593 402f90 12 API calls 20590->20593 20596 402f90 12 API calls 20591->20596 20594 404f42 20592->20594 20595 40496a GetProcAddress 20592->20595 20593->20567 20597 402f90 12 API calls 20594->20597 20598 404987 GetProcAddress 20595->20598 20599 404fd8 20595->20599 20596->20567 20597->20567 20601 4049a4 GetProcAddress 20598->20601 20602 404fba 20598->20602 20600 402f90 12 API calls 20599->20600 20600->20567 20604 4049c1 GetProcAddress 20601->20604 20605 405014 20601->20605 20603 402f90 12 API calls 20602->20603 20603->20567 20606 404ff6 20604->20606 20607 4049de GetProcAddress 20604->20607 20608 402f90 12 API calls 20605->20608 20609 402f90 12 API calls 20606->20609 20610 4049fb GetProcAddress 20607->20610 20611 40506e 20607->20611 20608->20567 20609->20567 20613 405050 20610->20613 20614 404a18 GetProcAddress 20610->20614 20612 402f90 12 API calls 20611->20612 20612->20567 20617 402f90 12 API calls 20613->20617 20615 405032 20614->20615 20616 404a35 GetProcAddress 20614->20616 20618 402f90 12 API calls 20615->20618 20619 404a52 GetProcAddress 20616->20619 20620 40508c 20616->20620 20617->20567 20618->20567 20621 405122 20619->20621 20622 404a6f GetProcAddress 20619->20622 20623 402f90 12 API calls 20620->20623 20626 402f90 12 API calls 20621->20626 20624 405104 20622->20624 20625 404a8c GetProcAddress 20622->20625 20623->20567 20629 402f90 12 API calls 20624->20629 20627 4050e6 20625->20627 20628 404aa9 GetProcAddress 20625->20628 20626->20567 20630 402f90 12 API calls 20627->20630 20631 404ac6 GetProcAddress 20628->20631 20632 4050c8 20628->20632 20629->20567 20630->20567 20634 404ae3 GetProcAddress 20631->20634 20635 4050aa 20631->20635 20633 402f90 12 API calls 20632->20633 20633->20567 20636 405140 20634->20636 20637 404b00 GetProcAddress 20634->20637 20638 402f90 12 API calls 20635->20638 20641 402f90 12 API calls 20636->20641 20639 40517c 20637->20639 20640 404b1d GetProcAddress 20637->20640 20638->20567 20642 402f90 12 API calls 20639->20642 20643 404b3a GetProcAddress 20640->20643 20644 40515e 20640->20644 20641->20567 20642->20567 20645 404b57 GetProcAddress 20643->20645 20646 4051b8 20643->20646 20647 402f90 12 API calls 20644->20647 20649 404b74 GetProcAddress 20645->20649 20650 40519a 20645->20650 20648 402f90 12 API calls 20646->20648 20647->20567 20648->20567 20652 404b91 GetProcAddress 20649->20652 20653 4051f4 20649->20653 20651 402f90 12 API calls 20650->20651 20651->20567 20654 4051d6 20652->20654 20655 404bae GetProcAddress 20652->20655 20656 402f90 12 API calls 20653->20656 20657 402f90 12 API calls 20654->20657 20658 404bcb GetProcAddress 20655->20658 20659 40526c 20655->20659 20656->20567 20657->20567 20661 404be8 GetProcAddress 20658->20661 20662 40524e 20658->20662 20660 402f90 12 API calls 20659->20660 20660->20567 20663 405230 20661->20663 20664 404c05 GetProcAddress 20661->20664 20665 402f90 12 API calls 20662->20665 20668 402f90 12 API calls 20663->20668 20666 405212 20664->20666 20667 404c22 GetProcAddress 20664->20667 20665->20567 20669 402f90 12 API calls 20666->20669 20670 405320 20667->20670 20671 404c3f GetProcAddress 20667->20671 20668->20567 20669->20567 20674 402f90 12 API calls 20670->20674 20672 405302 20671->20672 20673 404c5c GetProcAddress 20671->20673 20677 402f90 12 API calls 20672->20677 20675 4052e4 20673->20675 20676 404c79 GetProcAddress 20673->20676 20674->20567 20680 402f90 12 API calls 20675->20680 20678 4052c6 20676->20678 20679 404c96 GetProcAddress 20676->20679 20677->20567 20681 402f90 12 API calls 20678->20681 20682 404cb3 GetProcAddress 20679->20682 20683 4052a8 20679->20683 20680->20567 20681->20567 20685 404cd0 GetProcAddress 20682->20685 20686 40528a 20682->20686 20684 402f90 12 API calls 20683->20684 20684->20567 20687 4053d4 20685->20687 20688 404ced GetProcAddress 20685->20688 20689 402f90 12 API calls 20686->20689 20692 402f90 12 API calls 20687->20692 20690 4053b6 20688->20690 20691 404d0a GetProcAddress 20688->20691 20689->20567 20695 402f90 12 API calls 20690->20695 20693 404d27 GetProcAddress 20691->20693 20694 405398 20691->20694 20692->20567 20697 404d44 GetProcAddress 20693->20697 20698 40537a 20693->20698 20696 402f90 12 API calls 20694->20696 20695->20567 20696->20567 20700 404d61 GetProcAddress 20697->20700 20701 40535c 20697->20701 20699 402f90 12 API calls 20698->20699 20699->20567 20703 40533e 20700->20703 20704 404d7e GetProcAddress 20700->20704 20702 402f90 12 API calls 20701->20702 20702->20567 20706 402f90 12 API calls 20703->20706 20704->20567 20705 405410 20704->20705 20707 402f90 12 API calls 20705->20707 20706->20567 20707->20567 20709 4044fb 20708->20709 20710 408b00 12 API calls 20709->20710 20711 40451c _wstat 20710->20711 20711->20467 20714 40549f 20712->20714 20715 4055b0 20714->20715 20716 405504 mbstowcs 20714->20716 20721 4055b8 20714->20721 20735 401980 20714->20735 20717 4055d7 _fileno _setmode 20715->20717 20715->20721 20716->20714 20718 405693 20716->20718 20720 4055fb _fileno _setmode 20717->20720 20719 402ed0 12 API calls 20718->20719 20719->20721 20722 405619 fflush 20720->20722 20721->20502 20723 40562a fflush 20722->20723 20724 40563b setbuf 20723->20724 20725 405654 setbuf 20724->20725 20726 40566d setbuf 20725->20726 20726->20502 20728 408c48 20727->20728 20729 408c9b 20727->20729 20730 408ca8 20728->20730 20731 408b00 12 API calls 20728->20731 20732 408c79 20728->20732 20729->20504 20730->20504 20731->20728 20733 408c80 free 20732->20733 20733->20733 20734 408c91 free 20733->20734 20734->20729 20736 4019a0 20735->20736 20737 401993 20735->20737 20738 402ed0 12 API calls 20736->20738 20737->20714 20739 4019ac 20738->20739 20739->20714 20741 401b30 20740->20741 20742 4019d9 20740->20742 20743 4046b0 13 API calls 20741->20743 20744 40ef60 6 API calls 20742->20744 20745 401b43 20743->20745 20746 4019fb 20744->20746 20745->20742 20747 401b51 20745->20747 20748 401b70 20746->20748 20749 401a07 malloc 20746->20749 20752 402ed0 12 API calls 20747->20752 20753 403030 14 API calls 20748->20753 20750 401a1e 20749->20750 20751 401b9f 20749->20751 20754 401b00 20750->20754 20764 401a2c 20750->20764 20757 403030 14 API calls 20751->20757 20755 401af0 20752->20755 20756 401b8b 20753->20756 20767 401610 20754->20767 20755->20517 20756->20517 20758 401adc 20757->20758 20758->20755 20760 401ae2 fclose 20758->20760 20760->20755 20761 401b14 20761->20758 20762 401ac8 free 20761->20762 20762->20758 20763 401a73 fread 20763->20764 20765 401aa5 20763->20765 20764->20758 20764->20763 20766 403030 14 API calls 20765->20766 20766->20762 20791 40a4f0 20767->20791 20770 401672 malloc 20772 401688 malloc 20770->20772 20773 401919 20770->20773 20771 4018d4 20774 402ed0 12 API calls 20771->20774 20775 4018f9 20772->20775 20789 4016a4 20772->20789 20777 403030 14 API calls 20773->20777 20776 401846 20774->20776 20778 403030 14 API calls 20775->20778 20776->20761 20779 401938 20777->20779 20782 401826 20778->20782 20780 4016d5 fread 20780->20782 20783 401701 ferror 20780->20783 20781 401858 20781->20761 20784 401832 free free 20782->20784 20783->20782 20783->20789 20784->20776 20785 401770 fwrite 20787 40179c ferror 20785->20787 20790 4017e9 20785->20790 20786 402ed0 12 API calls 20786->20782 20787->20789 20787->20790 20788 40187f memcpy 20788->20782 20788->20789 20789->20780 20789->20781 20789->20782 20789->20785 20789->20788 20789->20790 20790->20782 20790->20786 20794 40a3f0 20791->20794 20793 401668 20793->20770 20793->20771 20795 40a45c 20794->20795 20796 40a405 20794->20796 20795->20793 20796->20795 20797 40a43d malloc 20796->20797 20797->20795 20799 405e41 20798->20799 20800 405e78 20799->20800 20801 405eab 20799->20801 20803 405e89 20800->20803 20804 402ed0 12 API calls 20800->20804 20802 402ed0 12 API calls 20801->20802 20802->20803 20803->20524 20805 405ea0 20804->20805 20805->20524 20806->20305 20807->20308 20852 407b50 20808->20852 20810 401be7 20817 401d68 20810->20817 20861 407dd0 20810->20861 20812 401c0b 20813 401e16 20812->20813 20815 401c17 20812->20815 20814 403030 14 API calls 20813->20814 20814->20817 20816 401c22 20815->20816 20818 4046b0 13 API calls 20815->20818 20819 40ef60 6 API calls 20816->20819 20817->20351 20820 401d93 20818->20820 20821 401c3c 20819->20821 20820->20816 20822 401da0 20820->20822 20823 401df0 20821->20823 20824 401c44 20821->20824 20827 402ed0 12 API calls 20822->20827 20828 403030 14 API calls 20823->20828 20825 401d30 20824->20825 20826 401c4e malloc 20824->20826 20832 401610 24 API calls 20825->20832 20829 401c64 20826->20829 20830 401e3c 20826->20830 20831 401d44 20827->20831 20828->20831 20834 401cda fread 20829->20834 20843 401c6d 20829->20843 20833 403030 14 API calls 20830->20833 20835 401d5c fclose 20831->20835 20836 401d4d fclose 20831->20836 20832->20831 20833->20831 20838 401d01 20834->20838 20839 401c78 fwrite 20834->20839 20835->20817 20836->20835 20837 401d22 free 20837->20831 20841 403030 14 API calls 20838->20841 20839->20829 20840 401dc0 20839->20840 20842 403030 14 API calls 20840->20842 20841->20837 20842->20843 20843->20837 20847 402328 20844->20847 20845 40232c strcmp 20845->20847 20848 40235b 20845->20848 20846 402ed0 12 API calls 20846->20847 20847->20845 20847->20846 20847->20848 20848->20351 20933 40e660 setlocale 20849->20933 20853 407b70 20852->20853 20854 407b64 20852->20854 20891 402270 strlen 20853->20891 20854->20810 20856 407b80 20897 407940 20856->20897 20858 407b92 20859 407b96 20858->20859 20860 402ed0 12 API calls 20858->20860 20859->20810 20860->20854 20862 407dde 20861->20862 20863 4074f0 3 API calls 20862->20863 20864 407e07 20863->20864 20865 407f05 20864->20865 20866 4074f0 3 API calls 20864->20866 20865->20812 20867 407e3c 20866->20867 20867->20865 20868 407e47 strlen strtok 20867->20868 20869 407f18 20868->20869 20890 407e6b 20868->20890 20870 408b00 12 API calls 20869->20870 20872 407f33 _wstat 20870->20872 20871 407e78 strlen 20871->20865 20873 407e8c strlen strcpy strtok 20871->20873 20874 407f67 20872->20874 20875 407f48 20872->20875 20873->20869 20876 407ec2 20873->20876 20878 4046b0 13 API calls 20874->20878 20877 407f53 20875->20877 20884 407650 18 API calls 20875->20884 20879 408b00 12 API calls 20876->20879 20880 407ef5 20877->20880 20881 407f57 20877->20881 20882 407f77 20878->20882 20883 407ed6 _wstat 20879->20883 20885 402f30 12 API calls 20880->20885 20886 402f30 12 API calls 20881->20886 20882->20812 20883->20871 20883->20890 20888 407f8e 20884->20888 20885->20865 20886->20874 20887 408d40 13 API calls 20887->20890 20888->20881 20889 407f9e free 20888->20889 20889->20877 20890->20871 20890->20887 20896 402298 20891->20896 20892 4022be 20892->20856 20893 4022d0 strncmp 20894 4022ef 20893->20894 20893->20896 20894->20856 20895 402ed0 12 API calls 20895->20896 20896->20892 20896->20893 20896->20895 20898 40794e 20897->20898 20899 4079a7 GetTempPathW _getpid 20898->20899 20900 40795b 20898->20900 20902 4074c0 7 API calls 20899->20902 20901 407650 18 API calls 20900->20901 20903 407967 20901->20903 20904 4079e9 _wtempnam 20902->20904 20905 4077c0 23 API calls 20903->20905 20906 408d40 13 API calls 20904->20906 20907 40797a 20905->20907 20908 407a00 20906->20908 20909 407984 _wputenv_s free 20907->20909 20910 407a8a 20907->20910 20911 407ab0 20908->20911 20912 407a08 free 20908->20912 20909->20899 20913 407aa0 20909->20913 20910->20858 20914 408920 15 API calls 20911->20914 20912->20904 20915 407a15 20912->20915 20916 402ed0 12 API calls 20913->20916 20917 407ad0 free 20914->20917 20915->20910 20918 407a50 20915->20918 20919 407a28 20915->20919 20920 407aae 20916->20920 20921 407a42 20917->20921 20922 407ae7 20917->20922 20926 408b00 12 API calls 20918->20926 20925 407700 15 API calls 20919->20925 20920->20921 20921->20858 20923 407b0c 20922->20923 20924 407aef 20922->20924 20929 408b00 12 API calls 20923->20929 20927 407700 15 API calls 20924->20927 20928 407a3a free 20925->20928 20930 407a6c SetEnvironmentVariableW free 20926->20930 20931 407aff free 20927->20931 20928->20921 20932 407b28 SetEnvironmentVariableW free 20929->20932 20930->20910 20931->20921 20932->20921 20934 40e690 setlocale 20933->20934 20935 40e686 _strdup 20933->20935 20936 40e6a8 20934->20936 20937 40e6ad wcstombs realloc wcstombs setlocale free 20934->20937 20935->20934 20936->20937 20938 40e720 mbstowcs 20936->20938 20939 40438f strcpy 20937->20939 20940 40e630 20938->20940 20939->20349 20941 40e74c mbstowcs 20940->20941 20942 40e76b 20941->20942 20943 40e783 20942->20943 20944 40e790 20942->20944 20943->20937 20945 40e890 wcstombs realloc wcstombs 20944->20945 20946 40e80d wcstombs 20944->20946 20947 40e8db setlocale free 20945->20947 20948 40e822 20946->20948 20949 40e826 wcstombs 20946->20949 20947->20939 20948->20949 20949->20947 20951 4070f0 20950->20951 20952 406d81 GetProcAddress 20950->20952 20953 402f90 12 API calls 20951->20953 20954 407126 20952->20954 20955 406d9e GetProcAddress 20952->20955 21012 4070e7 20953->21012 20958 402f90 12 API calls 20954->20958 20956 40710b 20955->20956 20957 406dbb GetProcAddress 20955->20957 20961 402f90 12 API calls 20956->20961 20959 406dd8 GetProcAddress 20957->20959 20960 40715c 20957->20960 20958->21012 20962 407141 20959->20962 20963 406df5 GetProcAddress 20959->20963 20964 402f90 12 API calls 20960->20964 20961->21012 20967 402f90 12 API calls 20962->20967 20965 406e12 GetProcAddress 20963->20965 20966 4071b6 20963->20966 20964->21012 20968 407198 20965->20968 20969 406e2f GetProcAddress 20965->20969 20970 402f90 12 API calls 20966->20970 20967->21012 20971 402f90 12 API calls 20968->20971 20972 40717a 20969->20972 20973 406e4c GetProcAddress 20969->20973 20970->21012 20971->21012 20974 402f90 12 API calls 20972->20974 20975 4071d4 20973->20975 20976 406e69 GetProcAddress 20973->20976 20974->21012 20977 402f90 12 API calls 20975->20977 20978 406e86 GetProcAddress 20976->20978 20979 40724c 20976->20979 20977->21012 20981 406ea3 GetProcAddress 20978->20981 20982 40722e 20978->20982 20980 402f90 12 API calls 20979->20980 20980->21012 20984 407210 20981->20984 20985 406ec0 GetProcAddress 20981->20985 20983 402f90 12 API calls 20982->20983 20983->21012 20986 402f90 12 API calls 20984->20986 20987 4071f2 20985->20987 20988 406edd GetProcAddress 20985->20988 20986->21012 20989 402f90 12 API calls 20987->20989 20990 4072c4 20988->20990 20991 406efa GetProcAddress 20988->20991 20989->21012 20994 402f90 12 API calls 20990->20994 20992 4072a6 20991->20992 20993 406f17 GetProcAddress 20991->20993 20995 402f90 12 API calls 20992->20995 20996 406f34 GetProcAddress 20993->20996 20997 407288 20993->20997 20994->21012 20995->21012 20998 406f51 GetProcAddress 20996->20998 20999 40726a 20996->20999 21000 402f90 12 API calls 20997->21000 21001 4072e2 20998->21001 21002 406f6e GetProcAddress 20998->21002 21003 402f90 12 API calls 20999->21003 21000->21012 21006 402f90 12 API calls 21001->21006 21004 407300 21002->21004 21005 406f8b GetProcAddress 21002->21005 21003->21012 21009 402f90 12 API calls 21004->21009 21007 406fa8 GetProcAddress 21005->21007 21008 40733c 21005->21008 21006->21012 21010 406fc5 GetProcAddress 21007->21010 21011 40731e 21007->21011 21013 402f90 12 API calls 21008->21013 21009->21012 21014 406fe2 GetProcAddress 21010->21014 21015 407396 21010->21015 21016 402f90 12 API calls 21011->21016 21012->20365 21013->21012 21017 407378 21014->21017 21018 406fff GetProcAddress 21014->21018 21019 402f90 12 API calls 21015->21019 21016->21012 21020 402f90 12 API calls 21017->21020 21021 40735a 21018->21021 21022 40701c GetProcAddress 21018->21022 21019->21012 21020->21012 21023 402f90 12 API calls 21021->21023 21024 4073b4 21022->21024 21025 407039 GetProcAddress 21022->21025 21023->21012 21026 402f90 12 API calls 21024->21026 21027 407056 GetProcAddress 21025->21027 21028 40742c 21025->21028 21026->21012 21030 407073 GetProcAddress 21027->21030 21031 40740e 21027->21031 21029 402f90 12 API calls 21028->21029 21029->21012 21033 4073f0 21030->21033 21034 407090 GetProcAddress 21030->21034 21032 402f90 12 API calls 21031->21032 21032->21012 21035 402f90 12 API calls 21033->21035 21036 4073d2 21034->21036 21037 4070ad GetProcAddress 21034->21037 21035->21012 21038 402f90 12 API calls 21036->21038 21039 40744a 21037->21039 21040 4070ca GetProcAddress 21037->21040 21038->21012 21042 402f90 12 API calls 21039->21042 21040->21012 21041 407468 21040->21041 21043 402f90 12 API calls 21041->21043 21042->21012 21043->21012 21045 40337f 21044->21045 21101 4032f0 21045->21101 21048 403439 21048->20368 21049 404300 21 API calls 21050 4033c1 21049->21050 21107 4032a0 21050->21107 21053 403402 21055 407b50 67 API calls 21053->21055 21054 4032a0 9 API calls 21056 403497 21054->21056 21057 40340a 21055->21057 21056->21053 21058 40349f 21056->21058 21059 403430 21057->21059 21112 407fd0 21057->21112 21060 4032a0 9 API calls 21058->21060 21059->21048 21061 402ed0 12 API calls 21059->21061 21063 4034ca 21060->21063 21061->21048 21064 4034d2 21063->21064 21066 4032a0 9 API calls 21063->21066 21065 407b50 67 API calls 21064->21065 21068 4035dc 21064->21068 21073 4034e0 21065->21073 21067 4035a8 21066->21067 21067->21064 21069 4032a0 9 API calls 21067->21069 21070 402ed0 12 API calls 21068->21070 21069->21064 21070->21048 21071 4035e8 21075 4021e0 15 API calls 21071->21075 21072 403510 strcmp 21072->21073 21074 403523 21072->21074 21073->21068 21073->21071 21073->21072 21076 40352b 21074->21076 21077 40353c strcmp 21074->21077 21080 401980 12 API calls 21074->21080 21078 4035f9 21075->21078 21076->21048 21083 402ed0 12 API calls 21076->21083 21077->21074 21079 403556 21077->21079 21078->21068 21133 403270 21078->21133 21081 401bd0 101 API calls 21079->21081 21080->21074 21081->21076 21085 403574 21083->21085 21085->20368 21086 4036d0 21087 402ed0 12 API calls 21086->21087 21089 4036dc 21087->21089 21088 403270 3 API calls 21090 403667 21088->21090 21091 402220 2 API calls 21089->21091 21090->21086 21092 403270 3 API calls 21090->21092 21091->21068 21093 40369c 21092->21093 21093->21086 21094 4036a3 21093->21094 21095 401e60 31 API calls 21094->21095 21096 4036ba 21095->21096 21097 4036c2 21096->21097 21098 402ed0 12 API calls 21096->21098 21097->20368 21099 403728 21098->21099 21100 402220 2 API calls 21099->21100 21100->21068 21102 403270 3 API calls 21101->21102 21103 40331d 21102->21103 21104 403324 strchr 21103->21104 21106 40334f 21103->21106 21105 403338 strcpy 21104->21105 21104->21106 21105->21106 21106->21048 21106->21049 21108 40f100 3 API calls 21107->21108 21109 4032c8 21108->21109 21110 4032df 21109->21110 21136 40ed40 21109->21136 21110->21053 21110->21054 21113 407fdd 21112->21113 21114 4046b0 13 API calls 21113->21114 21115 407ff6 21114->21115 21116 407dd0 41 API calls 21115->21116 21118 408012 21116->21118 21117 4080e8 21119 4080c5 21117->21119 21120 4080bd fclose 21117->21120 21118->21117 21121 408024 21118->21121 21122 4080dc 21118->21122 21119->21059 21120->21119 21123 408030 feof 21121->21123 21122->21117 21124 4080e0 fclose 21122->21124 21125 408040 fread 21123->21125 21126 4080d8 21123->21126 21124->21117 21128 408080 fwrite 21125->21128 21129 408060 ferror 21125->21129 21127 4080b5 fclose 21126->21127 21127->21120 21130 4080a8 clearerr 21128->21130 21131 40809c ferror 21128->21131 21129->21123 21132 40806c clearerr 21129->21132 21130->21127 21131->21123 21131->21130 21132->21127 21132->21128 21134 40f100 3 API calls 21133->21134 21135 403297 21134->21135 21135->21086 21135->21088 21137 40ed53 21136->21137 21138 40ed5c _stat 21136->21138 21137->21138 21139 40edc0 strlen 21137->21139 21140 40ed6e 21138->21140 21139->21138 21144 40edcf 21139->21144 21140->21110 21141 40ee4e 21141->21138 21142 40edf5 malloc memcpy _stat 21142->21140 21143 40ee36 free 21142->21143 21143->21140 21144->21138 21144->21141 21144->21142 21146 40e630 21145->21146 21147 407cfe wcscmp 21146->21147 21148 407d30 wcscmp 21147->21148 21160 407c99 _wfindnext 21147->21160 21149 407d44 wcscat 21148->21149 21148->21160 21150 407d90 _wremove 21149->21150 21151 407d63 21149->21151 21153 407d9c Sleep _wremove 21150->21153 21150->21160 21161 408f20 FindFirstFileExW 21151->21161 21153->21160 21155 407dc0 _wrmdir 21155->21160 21156 407d6c 21157 408920 15 API calls 21156->21157 21158 407d84 21157->21158 21159 407bc0 25 API calls 21158->21159 21159->21160 21160->20398 21160->20402 21162 408f66 FindClose 21161->21162 21163 407d68 21161->21163 21162->21163 21163->21155 21163->21156 21164 4017f4 21171 4016b1 21164->21171 21165 401770 fwrite 21166 40179c ferror 21165->21166 21172 4017e9 21165->21172 21166->21171 21166->21172 21167 40187f memcpy 21168 401826 21167->21168 21167->21171 21170 401832 free free 21168->21170 21169 402ed0 12 API calls 21169->21168 21173 401846 21170->21173 21171->21165 21171->21167 21171->21168 21171->21172 21174 4016d5 fread 21171->21174 21175 401858 21171->21175 21172->21168 21172->21169 21174->21168 21176 401701 ferror 21174->21176 21176->21168 21176->21171 21177 4018b6 21178 401826 21177->21178 21179 401832 free free 21178->21179 21180 401846 21179->21180 21181 408e58 21182 408e60 GetTokenInformation 21181->21182 21183 408ea1 calloc 21182->21183 21184 408e92 GetLastError 21182->21184 21185 408d96 21183->21185 21186 408ec3 GetTokenInformation 21183->21186 21184->21183 21184->21185 21187 408d9c free 21185->21187 21186->21187 21188 408eeb ConvertSidToStringSidW 21186->21188 21189 408db9 _snwprintf LocalFree ConvertStringSecurityDescriptorToSecurityDescriptorW 21187->21189 21190 408dad FindCloseChangeNotification 21187->21190 21188->21187 21191 408e4d 21189->21191 21192 408e2c CreateDirectoryW 21189->21192 21190->21189 21192->21191

                                                                                                                                                                                                                        Executed Functions

                                                                                                                                                                                                                        Function 0040117C Relevance: 18.2, APIs: 12, Instructions: 206sleepCOMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 323 40117c-40119a 324 4011a0-4011b1 323->324 325 401451-40145a GetStartupInfoW 323->325 326 4011cc-4011d8 324->326 329 401462-401477 _cexit 325->329 327 4011b8-4011ba 326->327 328 4011da-4011e4 326->328 330 4011c0-4011c9 Sleep 327->330 331 4013f3-401400 327->331 332 401406-40141a _amsg_exit 328->332 333 4011ea-4011f1 328->333 330->326 331->332 331->333 334 401420-401440 _initterm 332->334 335 40120f-401211 332->335 336 4011f7-401209 333->336 337 401478-401491 _initterm 333->337 338 401446-40144c 334->338 339 401217-40121e 334->339 335->338 335->339 336->334 336->335 342 40149b 337->342 338->339 340 401220-401239 339->340 341 40123c-40127c call 40db40 SetUnhandledExceptionFilter call 4173c0 call 40d970 __p__wcmdln 339->341 340->341 351 401292-401299 341->351 352 40127e 341->352 345 4014a3-4014af exit 342->345 353 401280-401283 351->353 354 40129b-4012a7 351->354 355 4012cd-4012d5 352->355 357 401285-401288 353->357 358 4012a9-4012b0 353->358 356 40128f 354->356 359 4012d7-4012e0 355->359 360 4012eb-40130b malloc 355->360 356->351 357->358 364 40128a 357->364 362 4012b2 358->362 363 4012c8 358->363 365 4012e6 359->365 366 4013ea 359->366 360->342 361 401311-40131d 360->361 367 401320-401326 361->367 368 4012b8-4012c6 362->368 363->355 364->356 365->360 366->331 369 4013e0-4013e5 367->369 370 40132c-401331 367->370 368->363 368->368 372 401346-40136d malloc memcpy 369->372 371 401338-401341 370->371 371->371 373 401343 371->373 372->367 374 40136f-4013bc call 40d770 call 40d7a0 372->374 373->372 374->345 379 4013c2-4013ca 374->379 379->329 380 4013d0-4013db 379->380
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled__p__wcmdlnmemcpy
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1204267290-0
                                                                                                                                                                                                                        • Opcode ID: eac8becde6c0dd191b15aea711b8aa84f0afa324810f6ed2f537ece7752c968d
                                                                                                                                                                                                                        • Instruction ID: 676354774380156a6d31bcdc11651c5caae96c91ab7a06ee3bbcf8190cbc5d75
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: eac8becde6c0dd191b15aea711b8aa84f0afa324810f6ed2f537ece7752c968d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BF81AF70A042018FDB24EFA4D98576A77F0FB44304F51453EDA85AB3B1D7789885CB8A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00401BD0 Relevance: 29.9, APIs: 6, Strings: 11, Instructions: 151COMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 00407DD0: strlen.MSVCRT ref: 00407E4A
                                                                                                                                                                                                                          • Part of subcall function 00407DD0: strtok.MSVCRT ref: 00407E5C
                                                                                                                                                                                                                          • Part of subcall function 00407DD0: strlen.MSVCRT ref: 00407E7B
                                                                                                                                                                                                                          • Part of subcall function 00407DD0: strlen.MSVCRT ref: 00407E8F
                                                                                                                                                                                                                          • Part of subcall function 00407DD0: strcpy.MSVCRT(?,?,00000000), ref: 00407EA3
                                                                                                                                                                                                                          • Part of subcall function 00407DD0: strtok.MSVCRT ref: 00407EB7
                                                                                                                                                                                                                          • Part of subcall function 00407DD0: _wstat.MSVCRT ref: 00407EE1
                                                                                                                                                                                                                        • malloc.MSVCRT ref: 00401C55
                                                                                                                                                                                                                        • fread.MSVCRT ref: 00401CF4
                                                                                                                                                                                                                        • free.MSVCRT ref: 00401D25
                                                                                                                                                                                                                        • fclose.MSVCRT ref: 00401D50
                                                                                                                                                                                                                        • fclose.MSVCRT ref: 00401D63
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to extract %s: failed to open archive file!, xrefs: 00401DA4
                                                                                                                                                                                                                        • fwrite, xrefs: 00401DD1
                                                                                                                                                                                                                        • fread, xrefs: 00401D12
                                                                                                                                                                                                                        • Failed to extract %s: failed to read data chunk!, xrefs: 00401D05
                                                                                                                                                                                                                        • Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00401E40
                                                                                                                                                                                                                        • Failed to extract %s: failed to write data chunk!, xrefs: 00401DC4
                                                                                                                                                                                                                        • Failed to extract %s: failed to seek to the entry's data!, xrefs: 00401DF4
                                                                                                                                                                                                                        • malloc, xrefs: 00401E4B
                                                                                                                                                                                                                        • fseek, xrefs: 00401E01
                                                                                                                                                                                                                        • Failed to extract %s: failed to open target file!, xrefs: 00401E1A
                                                                                                                                                                                                                        • fopen, xrefs: 00401E27
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: strlen$fclosestrtok$_wstatfreadfreemallocstrcpy
                                                                                                                                                                                                                        • String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                                                                                                                        • API String ID: 3544345225-666925554
                                                                                                                                                                                                                        • Opcode ID: 4440eb1eb03a3154bd87365db13383f04021bbf881c10f7881478c95f5f3f3c7
                                                                                                                                                                                                                        • Instruction ID: b5f998b2d191bd7786349188155599ad4440f4e1001f158a4c3b14c5a7e7e59c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4440eb1eb03a3154bd87365db13383f04021bbf881c10f7881478c95f5f3f3c7
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5C510AB05093419BD710EF29C48465FBBE1BF84354F118D2EF8E59B391D778E8858B4A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00407940 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 126COMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • _wputenv_s.MSVCRT ref: 0040798F
                                                                                                                                                                                                                        • free.MSVCRT ref: 0040799A
                                                                                                                                                                                                                        • GetTempPathW.KERNEL32(?,00000000,?,?,00407B92), ref: 004079BB
                                                                                                                                                                                                                        • _getpid.MSVCRT ref: 004079C4
                                                                                                                                                                                                                        • _wtempnam.MSVCRT ref: 004079F0
                                                                                                                                                                                                                        • free.MSVCRT ref: 00407A0B
                                                                                                                                                                                                                        • free.MSVCRT ref: 00407A3D
                                                                                                                                                                                                                          • Part of subcall function 00407650: GetEnvironmentVariableW.KERNEL32(00000000,00403DEA), ref: 0040768F
                                                                                                                                                                                                                          • Part of subcall function 004077C0: ExpandEnvironmentStringsW.KERNEL32(?,00000000,?,?,0040797A,?,00000000,?,?,00407B92), ref: 0040780C
                                                                                                                                                                                                                          • Part of subcall function 004077C0: free.MSVCRT ref: 0040781A
                                                                                                                                                                                                                          • Part of subcall function 004077C0: _wfullpath.MSVCRT ref: 0040784A
                                                                                                                                                                                                                          • Part of subcall function 004077C0: wcschr.MSVCRT ref: 00407877
                                                                                                                                                                                                                          • Part of subcall function 004077C0: wcsncpy.MSVCRT ref: 004078A7
                                                                                                                                                                                                                          • Part of subcall function 004077C0: CreateDirectoryW.KERNEL32 ref: 004078B7
                                                                                                                                                                                                                          • Part of subcall function 004077C0: wcschr.MSVCRT ref: 004078C7
                                                                                                                                                                                                                          • Part of subcall function 004077C0: CreateDirectoryW.KERNEL32 ref: 004078DD
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: free$CreateDirectoryEnvironmentwcschr$ExpandPathStringsTempVariable_getpid_wfullpath_wputenv_s_wtempnamwcsncpy
                                                                                                                                                                                                                        • String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
                                                                                                                                                                                                                        • API String ID: 2180377646-1116378104
                                                                                                                                                                                                                        • Opcode ID: 927dc99b90c32e611f2856e2e49529ac9b62f84a9827835374f0d536856b72f9
                                                                                                                                                                                                                        • Instruction ID: 01c5aea6ddf612d932d95327d8216bd8a762320b70d46ed771eeb73c9fc8ba7f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 927dc99b90c32e611f2856e2e49529ac9b62f84a9827835374f0d536856b72f9
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8E41CCB1A0D7008FD710BF65E58536FBBE0AF84744F02882EE5C897242D77D94859B9B
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00401610 Relevance: 28.2, APIs: 9, Strings: 7, Instructions: 186fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 86 401610-40166c call 40a4f0 89 401672-401682 malloc 86->89 90 4018d4-4018f4 call 402ed0 86->90 91 401688-40169e malloc 89->91 92 401919-401938 call 403030 89->92 99 401846-401852 90->99 94 4016a4-4016ad 91->94 95 4018f9-401914 call 403030 91->95 98 4016b1-4016cf 94->98 107 401826-401841 call 40c7c0 free * 2 95->107 102 4016d5-4016fb fread 98->102 103 401858-401868 98->103 105 4018c0-4018c5 102->105 106 401701-40170f ferror 102->106 105->107 106->105 109 401715-40171d 106->109 107->99 111 401721-40174a call 40a5c0 109->111 114 401750-401753 111->114 115 4017f8-4017fb 111->115 117 401759-40176a 114->117 118 401806-40181d 114->118 116 401801 115->116 115->117 116->118 119 401870-401879 117->119 120 401770-401796 fwrite 117->120 118->107 121 401821 call 402ed0 118->121 124 4017b4-4017b6 119->124 125 40187f-4018b1 memcpy 119->125 122 4018ca-4018cf 120->122 123 40179c-4017aa ferror 120->123 121->107 122->118 123->122 126 4017b0 123->126 124->111 127 4017bc-4017dd 124->127 125->105 125->124 126->124 127->107 128 4017df-4017e3 127->128 128->98 129 4017e9-4017f0 128->129 129->107 130 4017f2 129->130 130->118
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • 8, xrefs: 00401620
                                                                                                                                                                                                                        • Failed to extract %s: decompression resulted in return code %d!, xrefs: 00401813
                                                                                                                                                                                                                        • Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 004018E1
                                                                                                                                                                                                                        • Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 0040191D
                                                                                                                                                                                                                        • malloc, xrefs: 00401908, 00401925
                                                                                                                                                                                                                        • Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 004018FC
                                                                                                                                                                                                                        • 1.2.13, xrefs: 00401628
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ferrorfreemalloc$freadfwritememcpy
                                                                                                                                                                                                                        • String ID: 1.2.13$8$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                                                        • API String ID: 3882407908-2046485118
                                                                                                                                                                                                                        • Opcode ID: 5aace083163d09cb8bea982305f06aca8e3756abcd3827cc7d3909b427364719
                                                                                                                                                                                                                        • Instruction ID: 36ffe3033784580453c6a567143783feaca3ec72a60cee7d1f4dfc22211088d5
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5aace083163d09cb8bea982305f06aca8e3756abcd3827cc7d3909b427364719
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F481D3B56093019FD750EF29C08461BBBE1BF88358F508A2EF4D8973A1E778D985CB46
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00401E60 Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 165COMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 131 401e60-401e6f 132 402020-402039 call 4046b0 131->132 133 401e75-401eb0 call 408550 131->133 132->133 139 40203f-402044 132->139 138 401eb6-401ece call 40ef60 133->138 133->139 143 401ed4-401ef7 fread 138->143 144 40208f-4020a3 call 403030 138->144 141 402014-40201d 139->141 146 402061-40207a call 403030 143->146 147 401efd-401f67 call 40ef60 malloc 143->147 144->139 146->141 153 4020a5-4020bc call 403030 147->153 154 401f6d-401f89 fread 147->154 153->141 155 402046-40205f call 403030 154->155 156 401f8f-401fa6 ferror 154->156 155->141 159 40207c-40208d call 402ed0 156->159 160 401fac-401fb2 156->160 159->141 163 401fb8-401fba 160->163 165 402000-402004 163->165 166 401fbc-401fdf 163->166 165->141 169 402006-40200e fclose 165->169 166->163 168 401fe1-401ff4 call 402ed0 166->168 168->166 172 401ff6-401ffd 168->172 169->141 172->165
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 00408550: malloc.MSVCRT ref: 00408562
                                                                                                                                                                                                                          • Part of subcall function 00408550: fread.MSVCRT ref: 00408656
                                                                                                                                                                                                                          • Part of subcall function 00408550: free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401EAA), ref: 004086BF
                                                                                                                                                                                                                        • fread.MSVCRT ref: 00401EF0
                                                                                                                                                                                                                        • malloc.MSVCRT ref: 00401F5D
                                                                                                                                                                                                                        • fread.MSVCRT ref: 00401F82
                                                                                                                                                                                                                        • ferror.MSVCRT ref: 00401F9D
                                                                                                                                                                                                                        • fclose.MSVCRT ref: 00402009
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: fread$malloc$fcloseferrorfree
                                                                                                                                                                                                                        • String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$X$fread$fseek$malloc
                                                                                                                                                                                                                        • API String ID: 938791849-202209224
                                                                                                                                                                                                                        • Opcode ID: 184307eea2abe11cbc5b19158909a6000e688a56696f3d40b4622786db81104a
                                                                                                                                                                                                                        • Instruction ID: 48232b83441798ba76066763261cf49e77d2abc7de2ba2fc6216de52d01d1662
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 184307eea2abe11cbc5b19158909a6000e688a56696f3d40b4622786db81104a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 40616EB0905301CFCB04DF25C58865ABBE1BF88314F15C96EE9989B3D6D778D884CB9A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040E900 Relevance: 27.3, APIs: 18, Instructions: 269COMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 173 40e900-40e921 setlocale 174 40e923-40e92b _strdup 173->174 175 40e92d-40e946 setlocale 173->175 174->175 176 40e950-40e9b1 wcstombs realloc wcstombs setlocale free 175->176 177 40e948-40e94e 175->177 179 40e9b7-40e9c0 176->179 177->176 178 40e9c8-40ea1f mbstowcs call 40e630 mbstowcs 177->178 182 40ea60-40ea64 178->182 183 40ea21-40ea32 178->183 186 40ea67-40ea6c 182->186 184 40ec40-40ec44 183->184 185 40ea38-40ea3c 183->185 184->186 187 40ec4a-40ec4f 184->187 185->184 188 40ea42-40ea46 185->188 189 40ea80-40ea89 186->189 190 40ea6e-40ea71 186->190 187->186 191 40ec55-40ec70 setlocale free 187->191 188->186 192 40ea48-40ea56 188->192 193 40eaa4-40eaa8 189->193 190->176 196 40eb66-40eb69 191->196 192->186 194 40ea90-40ea96 193->194 195 40eaaa-40eab1 193->195 197 40ea98-40eaa2 194->197 198 40eabb-40eac2 194->198 199 40eab3-40eab7 195->199 200 40eac4-40eac8 195->200 196->179 197->193 201 40ead8-40eadb 197->201 198->200 202 40eab8 198->202 199->202 200->202 203 40eaca-40eacf 200->203 205 40eb70-40eb78 201->205 206 40eae1-40eae9 201->206 202->198 203->201 204 40ead1-40ead3 203->204 204->197 207 40eccb 205->207 208 40eb7e-40eb85 205->208 209 40eaeb-40eaef 206->209 210 40eafc-40eb49 wcstombs realloc wcstombs 206->210 211 40ecd1-40ecd9 207->211 212 40eb8d-40eb9c 207->212 208->205 213 40eb87-40eb8b 208->213 209->210 214 40eaf1-40eaf9 209->214 215 40eb4e-40eb61 setlocale free 210->215 216 40ece5-40eced 211->216 217 40ecdb-40ecdf 211->217 218 40ebb0-40ebbb 212->218 219 40eb9e-40eba2 212->219 213->205 213->212 214->210 215->196 216->212 220 40ecf3-40ecfb 216->220 217->212 217->216 218->218 223 40ebbd-40ebc1 218->223 221 40ec75-40ec79 219->221 222 40eba8-40ebaf 219->222 220->212 224 40ed01-40ed08 220->224 226 40ebd0 221->226 227 40ec7f-40ec82 221->227 222->218 223->218 225 40ebc3-40ebca 223->225 224->212 225->221 225->226 228 40ebd2-40ebd5 226->228 227->228 229 40ec9b-40ecbc wcstombs 228->229 230 40ebdb-40ebe0 228->230 229->215 232 40ecc2-40ecc6 229->232 231 40ec06-40ec11 230->231 233 40ec13 231->233 234 40ebe8-40ebf3 231->234 232->215 235 40ec16-40ec1a 233->235 236 40ec90-40ec92 234->236 237 40ebf9-40ebfb 234->237 238 40ec28-40ec33 235->238 239 40ec1c-40ec22 235->239 236->235 240 40ebfd-40ec00 237->240 238->238 242 40ec35-40ec39 238->242 239->240 241 40ec24 239->241 240->231 243 40ec98 240->243 241->238 242->238 244 40ec3b 242->244 243->229 244->240
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: setlocale$wcstombs$_strdupfreerealloc
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2293806352-0
                                                                                                                                                                                                                        • Opcode ID: 24aa9c2407c2a4c3f4ed46904f0d809acaa0fb0afecc03c31603bba52fa15124
                                                                                                                                                                                                                        • Instruction ID: 614429c9ea5f0c0fbdd7ec2be82af17343d93239b7468d5b99009060838935dd
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 24aa9c2407c2a4c3f4ed46904f0d809acaa0fb0afecc03c31603bba52fa15124
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 48A161709042158ADB24AF66C0452BBF7F1FF44344F45883FE489A7391E33D9892DB8A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00408D40 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 108COMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(?,?,?,?,?,00000005,?,?,00000000,00407A00), ref: 00408D68
                                                                                                                                                                                                                        • OpenProcessToken.ADVAPI32(?,?,?,?,?,00000005,?,?,00000000,00407A00), ref: 00408D81
                                                                                                                                                                                                                        • free.MSVCRT ref: 00408D9F
                                                                                                                                                                                                                        • FindCloseChangeNotification.KERNELBASE ref: 00408DB0
                                                                                                                                                                                                                        • _snwprintf.MSVCRT ref: 00408DDE
                                                                                                                                                                                                                        • LocalFree.KERNEL32 ref: 00408DE7
                                                                                                                                                                                                                        • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00408E1B
                                                                                                                                                                                                                        • CreateDirectoryW.KERNELBASE ref: 00408E3A
                                                                                                                                                                                                                        • GetTokenInformation.KERNELBASE ref: 00408E89
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 00408E92
                                                                                                                                                                                                                        • calloc.MSVCRT ref: 00408EB0
                                                                                                                                                                                                                        • GetTokenInformation.KERNELBASE ref: 00408EDA
                                                                                                                                                                                                                        • ConvertSidToStringSidW.ADVAPI32 ref: 00408EF4
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Token$ConvertDescriptorInformationProcessSecurityString$ChangeCloseCreateCurrentDirectoryErrorFindFreeLastLocalNotificationOpen_snwprintfcallocfree
                                                                                                                                                                                                                        • String ID: D:(A;;FA;;;%s)$S-1-3-4
                                                                                                                                                                                                                        • API String ID: 2844154730-2855260032
                                                                                                                                                                                                                        • Opcode ID: 35c38e4ae291b1630caa3689cb7816c22af486aa1896671bf02661883c98cb07
                                                                                                                                                                                                                        • Instruction ID: 945ac7356c52e091193055c5d6ee7abddb38f98d0a82e690350cb517e8796f62
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 35c38e4ae291b1630caa3689cb7816c22af486aa1896671bf02661883c98cb07
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2E41C4B05083009FE700AF69D68825EBBE4BF84755F418E2EF8D9A7291D778D548CF86
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00408190 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 107processsynchronizationCOMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                                                                                                                                                                                                        • SetConsoleCtrlHandler.KERNEL32(00000000,?,00000000,?,00404169), ref: 004081DB
                                                                                                                                                                                                                        • GetStartupInfoW.KERNEL32 ref: 00408203
                                                                                                                                                                                                                        • _fileno.MSVCRT ref: 0040824E
                                                                                                                                                                                                                        • _get_osfhandle.MSVCRT ref: 0040825C
                                                                                                                                                                                                                        • _fileno.MSVCRT ref: 00408277
                                                                                                                                                                                                                        • _get_osfhandle.MSVCRT ref: 0040827F
                                                                                                                                                                                                                        • _fileno.MSVCRT ref: 0040829A
                                                                                                                                                                                                                        • _get_osfhandle.MSVCRT ref: 004082A2
                                                                                                                                                                                                                        • GetCommandLineW.KERNEL32 ref: 004082B1
                                                                                                                                                                                                                        • CreateProcessW.KERNELBASE ref: 00408301
                                                                                                                                                                                                                        • WaitForSingleObject.KERNEL32 ref: 0040831D
                                                                                                                                                                                                                        • GetExitCodeProcess.KERNEL32 ref: 00408335
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: _fileno_get_osfhandle$Process$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
                                                                                                                                                                                                                        • String ID: CreateProcessW$Error creating child process!
                                                                                                                                                                                                                        • API String ID: 1833775142-3524285272
                                                                                                                                                                                                                        • Opcode ID: 32d5236159ff9933d5b80ff1d926fdea5f1ce6c1af8ead61a65d3641c3c49501
                                                                                                                                                                                                                        • Instruction ID: e1b98e6d24d483291a0d25806d4a7f2563c0c3411ac3d46acccf3020f7941406
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 32d5236159ff9933d5b80ff1d926fdea5f1ce6c1af8ead61a65d3641c3c49501
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E14195B05083448FD710AF69D58935EBBF0BF84314F418E2EE8D887291D7B99488CF96
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00408E58 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 86COMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • free.MSVCRT ref: 00408D9F
                                                                                                                                                                                                                        • FindCloseChangeNotification.KERNELBASE ref: 00408DB0
                                                                                                                                                                                                                        • _snwprintf.MSVCRT ref: 00408DDE
                                                                                                                                                                                                                        • LocalFree.KERNEL32 ref: 00408DE7
                                                                                                                                                                                                                        • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00408E1B
                                                                                                                                                                                                                        • CreateDirectoryW.KERNELBASE ref: 00408E3A
                                                                                                                                                                                                                        • GetTokenInformation.KERNELBASE ref: 00408E89
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 00408E92
                                                                                                                                                                                                                        • calloc.MSVCRT ref: 00408EB0
                                                                                                                                                                                                                        • GetTokenInformation.KERNELBASE ref: 00408EDA
                                                                                                                                                                                                                        • ConvertSidToStringSidW.ADVAPI32 ref: 00408EF4
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ConvertDescriptorInformationSecurityStringToken$ChangeCloseCreateDirectoryErrorFindFreeLastLocalNotification_snwprintfcallocfree
                                                                                                                                                                                                                        • String ID: D:(A;;FA;;;%s)$S-1-3-4
                                                                                                                                                                                                                        • API String ID: 897783455-2855260032
                                                                                                                                                                                                                        • Opcode ID: 2332b92793a97980f153f3f9263dafc3eb451ab906240b9714cbdf3afaf22637
                                                                                                                                                                                                                        • Instruction ID: 5ee2362bb1dffc1b92a9066ae5264b9d3527a87a2536074db898feb824fd9f33
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2332b92793a97980f153f3f9263dafc3eb451ab906240b9714cbdf3afaf22637
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8C31D3B05083009FE700AF69D68835EBBE0FF84715F01892EE8D9972A1D778D988CF46
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00407DD0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 122stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 285 407dd0-407e0c call 40e630 call 4074f0 290 407e12-407e41 call 4074f0 285->290 291 407f05-407f11 285->291 290->291 294 407e47-407e65 strlen strtok 290->294 295 407f18-407f46 call 408b00 _wstat 294->295 296 407e6b-407e72 294->296 301 407f67-407f81 call 4046b0 295->301 302 407f48-407f51 295->302 298 407e78-407e8a strlen 296->298 298->291 300 407e8c-407ec0 strlen strcpy strtok 298->300 300->295 303 407ec2-407ee9 call 408b00 _wstat 300->303 304 407f82-407f90 call 407650 302->304 305 407f53-407f55 302->305 303->298 315 407eeb-407ef3 call 408d40 303->315 317 407f92-407f98 304->317 318 407fb5-407fbf 304->318 308 407ef5-407f00 call 402f30 305->308 309 407f57-407f62 call 402f30 305->309 308->291 309->301 315->298 320 407f9a 317->320 321 407f9e-407fb3 free 317->321 318->309 320->321 321->305
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • ERROR: file already exists but should not: %s, xrefs: 00407EF9
                                                                                                                                                                                                                        • PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00407F82
                                                                                                                                                                                                                        • WARNING: file already exists but should not: %s, xrefs: 00407F5B
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: strlen$_wstatstrtok$ByteCharMultiWidefreestrcpy
                                                                                                                                                                                                                        • String ID: ERROR: file already exists but should not: %s$PYINSTALLER_STRICT_UNPACK_MODE$WARNING: file already exists but should not: %s
                                                                                                                                                                                                                        • API String ID: 439695417-1996835591
                                                                                                                                                                                                                        • Opcode ID: ae956383a1602fbf16243ccfb6895fa433991ee32204bf530d7f01d15dce0662
                                                                                                                                                                                                                        • Instruction ID: 0d1752cbd12df257bbbd412badab65e831f2b54a7211b67fa555c1920da682f5
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ae956383a1602fbf16243ccfb6895fa433991ee32204bf530d7f01d15dce0662
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: DE411CB050D7019AD310AF25D58429EBBE4EF84748F42883EE5C897391DB7CA4849B9B
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040EF90 Relevance: 9.1, APIs: 6, Instructions: 54COMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 381 40ef90-40efaa 382 40efd8-40efea fgetpos 381->382 383 40efac-40efaf 381->383 384 40f03c-40f041 382->384 385 40efec-40eff4 382->385 386 40f000-40f028 fflush _fileno _filelengthi64 383->386 387 40efb1-40efb3 383->387 389 40efcd-40efd4 384->389 385->386 388 40efc1-40efc8 fsetpos 385->388 386->388 390 40efb5-40efbd 387->390 391 40f02a-40f03a _errno 387->391 388->389 390->388 391->389
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: _errno_filelengthi64_filenofflushfgetposfsetpos
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 4183758535-0
                                                                                                                                                                                                                        • Opcode ID: 0e874d7c1527097df73717f8d8dd802be641f195fc25bc8155d28149c3b9a275
                                                                                                                                                                                                                        • Instruction ID: 4b13233adec89eef7c79cf0ca00fcee1fa5ec0274880c3d786e8fbaf61c832b7
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0e874d7c1527097df73717f8d8dd802be641f195fc25bc8155d28149c3b9a275
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7A113DB15087059BC310AF2A958105FBBE4EF91354F120D3FF89493292E239D999CB96
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00401DBB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28COMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 392 401dbb-401de1 free call 403030 398 401d5c-401d63 fclose 392->398 399 401d4d-401d55 fclose 392->399 400 401d68-401d71 398->400 399->398
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 00403030: _errno.MSVCRT ref: 00403064
                                                                                                                                                                                                                          • Part of subcall function 00403030: strerror.MSVCRT ref: 0040306F
                                                                                                                                                                                                                        • free.MSVCRT ref: 00401D25
                                                                                                                                                                                                                        • fclose.MSVCRT ref: 00401D50
                                                                                                                                                                                                                        • fclose.MSVCRT ref: 00401D63
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • fwrite, xrefs: 00401DD1
                                                                                                                                                                                                                        • Failed to extract %s: failed to write data chunk!, xrefs: 00401DC4
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: fclose$_errnofreestrerror
                                                                                                                                                                                                                        • String ID: Failed to extract %s: failed to write data chunk!$fwrite
                                                                                                                                                                                                                        • API String ID: 3523629215-1560601992
                                                                                                                                                                                                                        • Opcode ID: 9353a7da99b3be11b46e5f84fdf26ac4210b160aba239bd7510e2b4b1990afc0
                                                                                                                                                                                                                        • Instruction ID: aff44569ab8606813c7f29ae03d31c1d370def72fb3cd313521a05d94b0daf67
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9353a7da99b3be11b46e5f84fdf26ac4210b160aba239bd7510e2b4b1990afc0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 43F012B56093408BC700AF75E48519DB7E0BF80314F12892FF4999B291D338D485CB4A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00401DE6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25COMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 401 401de6-401e11 call 403030 406 401d5c-401d63 fclose 401->406 407 401d4d-401d55 fclose 401->407 408 401d68-401d71 406->408 407->406
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 00403030: _errno.MSVCRT ref: 00403064
                                                                                                                                                                                                                          • Part of subcall function 00403030: strerror.MSVCRT ref: 0040306F
                                                                                                                                                                                                                        • fclose.MSVCRT ref: 00401D50
                                                                                                                                                                                                                        • fclose.MSVCRT ref: 00401D63
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to extract %s: failed to seek to the entry's data!, xrefs: 00401DF4
                                                                                                                                                                                                                        • fseek, xrefs: 00401E01
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: fclose$_errnostrerror
                                                                                                                                                                                                                        • String ID: Failed to extract %s: failed to seek to the entry's data!$fseek
                                                                                                                                                                                                                        • API String ID: 531001455-144044986
                                                                                                                                                                                                                        • Opcode ID: 05b533b50c2bc4eff8379d834af169491f677ebbb3d68f1e93d9e12fa35dd1bd
                                                                                                                                                                                                                        • Instruction ID: b1b358e5bfedda9d4d999058601c1f88ca93a78291f5d028d604a8f107234477
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 05b533b50c2bc4eff8379d834af169491f677ebbb3d68f1e93d9e12fa35dd1bd
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D2F06C756053419BCB00AF39D844299B7F1FF80318F05892FF89997390D338E985CB49
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00408550 Relevance: 6.1, APIs: 4, Instructions: 119COMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 409 408550-40856b malloc 410 408571-40858f call 40ef60 409->410 411 4086b8-4086ba 409->411 410->411 415 408595-4085b8 call 40f050 410->415 413 4086bc-4086cf free 411->413 415->411 418 4085be-4085d2 415->418 419 4085d6-4085ec 418->419 420 4085fe-40861d 419->420 421 4085ee-4085f6 419->421 422 4086b2-4086b4 420->422 423 408623-40863d call 40ef60 420->423 421->420 422->411 423->422 426 40863f-40865d fread 423->426 426->422 427 40865f-408666 426->427 428 408690-408692 427->428 429 408670-40868c memcmp 428->429 430 408694-4086ac 428->430 431 4086d0-4086e6 429->431 432 40868e 429->432 430->419 430->422 431->413 432->428
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: freadfreemalloc
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2848089211-0
                                                                                                                                                                                                                        • Opcode ID: 1a9925d51e5002b52557f3f82c440e3fe1630ff818de9e7bab4658c492a1da82
                                                                                                                                                                                                                        • Instruction ID: cab96f3465d474487508a1ec879676b61213e1df38a8e45f68965f676f42926a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1a9925d51e5002b52557f3f82c440e3fe1630ff818de9e7bab4658c492a1da82
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 78413B716083118BC710DF29C58060FFBE1AFC8354F168E2EF9D897391EA79D8498B86
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040EFF6 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 433 40eff6-40effd 434 40f000-40f028 fsetpos fflush _fileno _filelengthi64 433->434 436 40efcd-40efd4 434->436
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: _filelengthi64_filenofflushfsetpos
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1406207278-0
                                                                                                                                                                                                                        • Opcode ID: 1ed6eb79ae09dcc32bdfa7ab410ec694ef2291df6c0a71ee54ab17ab7ac6ca82
                                                                                                                                                                                                                        • Instruction ID: 1330b5d8d42a305a2191b976321c9ddfa34460ad39984d8d2968ac2a071300d9
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1ed6eb79ae09dcc32bdfa7ab410ec694ef2291df6c0a71ee54ab17ab7ac6ca82
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5BE0EDB2908B158BC700BF66A88119DFBE0FF80358F134C2FE4D953212E638A5D58B86
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004066E0 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 14COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: calloc
                                                                                                                                                                                                                        • String ID: 0@$Cannot allocate memory for SPLASH_STATUS.$calloc
                                                                                                                                                                                                                        • API String ID: 2635317215-3108904453
                                                                                                                                                                                                                        • Opcode ID: 82d72ecdbd88522e30c842d19366d70def6be29cf6ee469c02a56ee1ccfb6e61
                                                                                                                                                                                                                        • Instruction ID: 91d9d8c6ef22e38f4f1b4844de6a5a16a8ab255c7dc3ef68476b647e8a5c5417
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 82d72ecdbd88522e30c842d19366d70def6be29cf6ee469c02a56ee1ccfb6e61
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0DD012B080E3008AC300AF21C15525E7AE4AF40704F85882EE5C557280D3BDC5959B8B
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00401D7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to extract %s: failed to open archive file!, xrefs: 00401DA4
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: fclose$_wfopenfreemalloc
                                                                                                                                                                                                                        • String ID: Failed to extract %s: failed to open archive file!
                                                                                                                                                                                                                        • API String ID: 409134274-2950503014
                                                                                                                                                                                                                        • Opcode ID: bc8c0f40a64667b258747b891fccd1e7d42742d54face0fde24ed5700ed4ad79
                                                                                                                                                                                                                        • Instruction ID: 7614606d81e887eecfecfed5343dc5ca5952679920abc2288eb417914ad53e33
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: bc8c0f40a64667b258747b891fccd1e7d42742d54face0fde24ed5700ed4ad79
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 93F01DB5A043059BDB00AF35E84419AB7E1BF80318F01893EE898DB391E738D8858B86
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040A090 Relevance: 5.1, APIs: 4, Instructions: 102COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: mallocmemcpy
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 4276657696-0
                                                                                                                                                                                                                        • Opcode ID: 02d46d53eafb68b30b763f551fb2a3305e08925e6983bdf89da9902f672765db
                                                                                                                                                                                                                        • Instruction ID: 797d5049136f8a5f83aef3165c4761c57e8610ee519af45eb6e184e31c624f88
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 02d46d53eafb68b30b763f551fb2a3305e08925e6983bdf89da9902f672765db
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 23311371605B008FC354DF3AD68065BFBE2FB88354F41993ED48A87B50E675F8858B41
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00407700 Relevance: 4.5, APIs: 3, Instructions: 30COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                                                                                                                                                                                                        • _wputenv_s.MSVCRT ref: 00407749
                                                                                                                                                                                                                        • free.MSVCRT(?,?,?,00407AFF), ref: 00407754
                                                                                                                                                                                                                        • free.MSVCRT(?,?,?,00407AFF), ref: 0040775C
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: free$ByteCharMultiWide_wputenv_s
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2386249605-0
                                                                                                                                                                                                                        • Opcode ID: 66de1e51653dac200d6a456545627f4f8aa75ccab6a0350049436974a35eccfd
                                                                                                                                                                                                                        • Instruction ID: 950e786cdc5d1bf19fb3b147057235cd525973657d6a811f6c43614b3b6a3ead
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 66de1e51653dac200d6a456545627f4f8aa75ccab6a0350049436974a35eccfd
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E3F0B7B1A093009BD700BF69E59975FBAE4EF84754F024D2EF4C897341D67988408B82
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004017F4 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 26fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to extract %s: decompression resulted in return code %d!, xrefs: 00401813
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: free$ferrorfwrite
                                                                                                                                                                                                                        • String ID: Failed to extract %s: decompression resulted in return code %d!
                                                                                                                                                                                                                        • API String ID: 2451956730-2259475180
                                                                                                                                                                                                                        • Opcode ID: 830b903f36b84025c492a9392f2ebfc8541cf9aaa14fb670190ebe148b401e78
                                                                                                                                                                                                                        • Instruction ID: 3822a968a1abd095370c554b2ca83eb16347efd21d9f73064333f8d65a1dff39
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 830b903f36b84025c492a9392f2ebfc8541cf9aaa14fb670190ebe148b401e78
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5AF01CB56097008BC710BF29E48105EBBE1FF81324F528A2EF5E897381D739D8818B86
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00401124 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: __wgetmainargs
                                                                                                                                                                                                                        • String ID: B
                                                                                                                                                                                                                        • API String ID: 1709950718-3394935788
                                                                                                                                                                                                                        • Opcode ID: 41afb40690170ecdc9a50beea52290fec0f59d8749ba09f0fc9408188c674ce4
                                                                                                                                                                                                                        • Instruction ID: 27c32f95ce735926b30c16c90320b224d17bcd53438576fbaefc61be872f07d1
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 41afb40690170ecdc9a50beea52290fec0f59d8749ba09f0fc9408188c674ce4
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 81E092B1A04711EFC714DF25E645246BBE0BB48308F81D91EE69897210D3B9A549DF8A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040A3F0 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 62COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: malloc
                                                                                                                                                                                                                        • String ID: 8
                                                                                                                                                                                                                        • API String ID: 2803490479-4194326291
                                                                                                                                                                                                                        • Opcode ID: 88865b5b26300d2bd4c71fb6e3d37b9dfb2c71bd695db075464367e8e3ddd3a1
                                                                                                                                                                                                                        • Instruction ID: 3d9a3cba30c8a6cce76611aecb6f7ccedd9577938697bd5609853f48fc3db6fb
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 88865b5b26300d2bd4c71fb6e3d37b9dfb2c71bd695db075464367e8e3ddd3a1
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 542159B45083018FDB10DF29C5886267BE0AF48314F51866EA8499B3C5E3B8CC65CF47
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00401D2C Relevance: 3.0, APIs: 2, Instructions: 23COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 00401610: malloc.MSVCRT ref: 00401679
                                                                                                                                                                                                                          • Part of subcall function 00401610: malloc.MSVCRT ref: 0040168F
                                                                                                                                                                                                                          • Part of subcall function 00401610: fread.MSVCRT ref: 004016F0
                                                                                                                                                                                                                          • Part of subcall function 00401610: ferror.MSVCRT ref: 00401706
                                                                                                                                                                                                                          • Part of subcall function 00401610: fwrite.MSVCRT ref: 0040178B
                                                                                                                                                                                                                          • Part of subcall function 00401610: ferror.MSVCRT ref: 004017A3
                                                                                                                                                                                                                        • fclose.MSVCRT ref: 00401D50
                                                                                                                                                                                                                        • fclose.MSVCRT ref: 00401D63
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: fcloseferrormalloc$freadfwrite
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2659978838-0
                                                                                                                                                                                                                        • Opcode ID: ba584c84dcc7021ed2e9611c05d47d0ae0c51191637eb14f3cb18bd1de7ff9c6
                                                                                                                                                                                                                        • Instruction ID: 2086b21a0a2fd9d0ee52b7dbb019afd7e35cf4cc68d36bcb5f0e3d1ef994c319
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ba584c84dcc7021ed2e9611c05d47d0ae0c51191637eb14f3cb18bd1de7ff9c6
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: ADE01A75B043008BCB00AF29E84035AB7E1AF84354F06482EF888CB351D739D884CB95
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004018B6 Relevance: 2.5, APIs: 2, Instructions: 19COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: free
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1294909896-0
                                                                                                                                                                                                                        • Opcode ID: ef69f32362a42e0ce2ffe8284a07d848220a277b661e213d5c3d7f37b51e11aa
                                                                                                                                                                                                                        • Instruction ID: 37d18b623566974bb2935c6215979c875cfe96a297bc96d00919041d074b5ac9
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ef69f32362a42e0ce2ffe8284a07d848220a277b661e213d5c3d7f37b51e11aa
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 80E0E6B6604715CBCB107F65F48119DF7E0FF41328F124A3FE9E493291D639A5454B86
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004046B0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                                                                                                                                                                                                        • _wfopen.MSVCRT ref: 00404703
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ByteCharMultiWide_wfopen
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 372205238-0
                                                                                                                                                                                                                        • Opcode ID: 13c07e3d3bc0b19f75017dbdb54b07b75c5c7dcab1f4d19b5ddeb740e7124e77
                                                                                                                                                                                                                        • Instruction ID: 3468f0b4211825adde8639be08c033172f5b0e4316271c3a96c81e3ef559f4c6
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 13c07e3d3bc0b19f75017dbdb54b07b75c5c7dcab1f4d19b5ddeb740e7124e77
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2FF0F2B04193009FC314FF28D58868EBBE8FF88348F018C2EF5C897252D6789549CB92
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040A4B1 Relevance: 1.3, APIs: 1, Instructions: 37COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: malloc
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2803490479-0
                                                                                                                                                                                                                        • Opcode ID: e2173ce04817a78d231aa9074b1aa79180b14f8ea2ab174e27efc7c36e8625ac
                                                                                                                                                                                                                        • Instruction ID: 34294cd6affbb3e785c4932bfc48d0f633533baf833ca0b38d678e79e0ec05fd
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e2173ce04817a78d231aa9074b1aa79180b14f8ea2ab174e27efc7c36e8625ac
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 87011EB45053018FDB54DF19C184356BBE0FF88304F55896EE8889B385D3B8C855CF46
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Non-executed Functions

                                                                                                                                                                                                                        Function 00406D50 Relevance: 164.9, APIs: 31, Strings: 63, Instructions: 385libraryloaderCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AddressProc
                                                                                                                                                                                                                        • String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                                                        • API String ID: 190572456-2208601799
                                                                                                                                                                                                                        • Opcode ID: 48fc8fb41c16fe699d029926af7cab486289aba105d4ff2453387a530e0e4b39
                                                                                                                                                                                                                        • Instruction ID: b9744897239d32f33dc6bfef900ed9271cf1591fb07702e628d33a7ecb5ec9b2
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 48fc8fb41c16fe699d029926af7cab486289aba105d4ff2453387a530e0e4b39
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C3F108B090A701CBC7106F759A4506EBAF0AE41758F40CA3FB4A49B2C1DB7C9499DB9F
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004086F0 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • FormatMessageW.KERNEL32(?,?,?,?,00402FD9), ref: 0040873F
                                                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32 ref: 00408787
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00402FD9), ref: 004087D0
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • PyInstaller: FormatMessageW failed., xrefs: 004087C2
                                                                                                                                                                                                                        • Failed to encode wchar_t as UTF-8., xrefs: 004087E0
                                                                                                                                                                                                                        • FormatMessageW, xrefs: 004087B0
                                                                                                                                                                                                                        • No error messages generated., xrefs: 004087A8
                                                                                                                                                                                                                        • WideCharToMultiByte, xrefs: 004087E8
                                                                                                                                                                                                                        • PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 004087FA
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ByteCharErrorFormatLastMessageMultiWide
                                                                                                                                                                                                                        • String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
                                                                                                                                                                                                                        • API String ID: 1653872744-2573406579
                                                                                                                                                                                                                        • Opcode ID: f18fbf8d48d34d915993c9fedb6177582b1632770400b321313a73d9a670d996
                                                                                                                                                                                                                        • Instruction ID: e5d7e6b934a0c345d3486c1070e2a035779d45014a63eb974780677ace9c2cb0
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f18fbf8d48d34d915993c9fedb6177582b1632770400b321313a73d9a670d996
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8B111AB45093018BE310AF69D54835BBAF0EB94389F50892EE4D49A285D7BD858C8BA7
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004014F0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 43libraryloaderCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AddressProc$HandleLibraryLoadModule
                                                                                                                                                                                                                        • String ID: , B$__deregister_frame_info$__register_frame_info$libgcc_s_dw2-1.dll
                                                                                                                                                                                                                        • API String ID: 384173800-2541462354
                                                                                                                                                                                                                        • Opcode ID: a376881f7d4377a9ad5e0e3f6ac5215553b1e171285a39ee36456c721ec719f3
                                                                                                                                                                                                                        • Instruction ID: 6c6c026f4a83c0f72c7764c329cd2c4586c53e905c616f5fc2452e48b3062107
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a376881f7d4377a9ad5e0e3f6ac5215553b1e171285a39ee36456c721ec719f3
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 200175B1805304ABD700BF79AD4425ABFF4EB44399F02853FE98957260D7789848CB9F
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00414570 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 1456COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: $ $9$Infinity$NaN
                                                                                                                                                                                                                        • API String ID: 0-2156819404
                                                                                                                                                                                                                        • Opcode ID: fb752ad01a167b7c3ce2d06964dcb0e38cd8f53d46aad30b3ca282ca9372ef33
                                                                                                                                                                                                                        • Instruction ID: 135e34cb9ca9e985b4a278f7eb7425a40accb92fd251a454e4488a178f868c55
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: fb752ad01a167b7c3ce2d06964dcb0e38cd8f53d46aad30b3ca282ca9372ef33
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 93D224B1A08781CFD720DF29C08479ABBE1BBC8354F15891EE89587351E779D885CF8A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004011B3 Relevance: 9.1, APIs: 6, Instructions: 119sleepCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: malloc$ExceptionFilterSleepUnhandled__p__wcmdln_amsg_exit_inittermmemcpy
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 527270645-0
                                                                                                                                                                                                                        • Opcode ID: 0fc769238dbcbaccc1defde77868a2231646de065e682eb93854c2df569345b0
                                                                                                                                                                                                                        • Instruction ID: 9529fa1fa00849a3a4482e99920bc3e8817caf8231a65d9ae2bb721758bc0f10
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0fc769238dbcbaccc1defde77868a2231646de065e682eb93854c2df569345b0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 45414DB4A043018FDB20EFA9D98475AB7F0FB44344F51453EE985A73B0DBB89845CB89
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004131C0 Relevance: 7.9, Strings: 6, Instructions: 424COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: .$@$Inf$NaN$gfff$gfff
                                                                                                                                                                                                                        • API String ID: 0-3155045678
                                                                                                                                                                                                                        • Opcode ID: 649fb20abb9812e0e09aa82762c5c86987e6c960a3fbba0dce5609d8b374321b
                                                                                                                                                                                                                        • Instruction ID: a46ccd9e596887ef7586e3f83d06ea90e66d5ef1390d3a99a1c477af4a84c032
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 649fb20abb9812e0e09aa82762c5c86987e6c960a3fbba0dce5609d8b374321b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F3F1E5717083018BD7149F29C48429BB7E1BF84345F188A6FE899DB355D738DE85CB4A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00410A20 Relevance: 7.9, Strings: 6, Instructions: 424COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: .$@$Inf$NaN$gfff$gfff
                                                                                                                                                                                                                        • API String ID: 0-3155045678
                                                                                                                                                                                                                        • Opcode ID: dab502d568537ec720aaf45a7e0f9e0a341b1c2f8383f2d09a6fbb2e9003e841
                                                                                                                                                                                                                        • Instruction ID: d384fdde2e77d5b6e892d09c38fe2caee72570f537571c461ee27f5ac1cb1202
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: dab502d568537ec720aaf45a7e0f9e0a341b1c2f8383f2d09a6fbb2e9003e841
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2EF1C7716083018BD7149E69C48469BB7D1BFC8314F148A2FF999DB345E7B8ECC58B8A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00401170 Relevance: 7.6, APIs: 5, Instructions: 135sleepCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled__p__wcmdlnmemcpy
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1204267290-0
                                                                                                                                                                                                                        • Opcode ID: b6dbdc372fc45292959b8ad62cb9b1d82b3ea37c5ee8f48f33ec792cbd8abaac
                                                                                                                                                                                                                        • Instruction ID: 683df0bb935b0ba919073670d03ce8182cb7faa8ee4b460d1895c998537b4a50
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b6dbdc372fc45292959b8ad62cb9b1d82b3ea37c5ee8f48f33ec792cbd8abaac
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0C5180B0A043019FDB20DFA8D984B5AB7F0FB44344F11453EE945AB3B1D7789845CB89
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040A670 Relevance: 7.0, Strings: 5, Instructions: 723COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • invalid block type, xrefs: 0040C008
                                                                                                                                                                                                                        • invalid literal/length code, xrefs: 0040C139
                                                                                                                                                                                                                        • invalid stored block lengths, xrefs: 0040AA6D
                                                                                                                                                                                                                        • incorrect data check, xrefs: 0040A858
                                                                                                                                                                                                                        • too many length or distance symbols, xrefs: 0040B5DB
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: incorrect data check$invalid block type$invalid literal/length code$invalid stored block lengths$too many length or distance symbols
                                                                                                                                                                                                                        • API String ID: 0-817236767
                                                                                                                                                                                                                        • Opcode ID: 732da43ed72cc2c4120bf8a60150f6b0ba1b7153d6323c3b09595d69c6cd98af
                                                                                                                                                                                                                        • Instruction ID: b6d793466c67ffd8e3b1f57c4bb4f26a608bbcae03501d0a96c59416067c7ba4
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 732da43ed72cc2c4120bf8a60150f6b0ba1b7153d6323c3b09595d69c6cd98af
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0C623B719183418FC754CF28C18462ABBF1FF88314F598A6EE999A7391D378E941CF86
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040AF90 Relevance: 6.8, Strings: 5, Instructions: 508COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • invalid distances set, xrefs: 0040C77C
                                                                                                                                                                                                                        • invalid literal/lengths set, xrefs: 0040C5EE
                                                                                                                                                                                                                        • invalid code -- missing end-of-block, xrefs: 0040BB65
                                                                                                                                                                                                                        • incorrect data check, xrefs: 0040A858
                                                                                                                                                                                                                        • invalid bit length repeat, xrefs: 0040C659
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: incorrect data check$invalid bit length repeat$invalid code -- missing end-of-block$invalid distances set$invalid literal/lengths set
                                                                                                                                                                                                                        • API String ID: 0-3719072575
                                                                                                                                                                                                                        • Opcode ID: 87f7b0a5de183da02882c39e40a9c5277c9a1d09e12685698913540847143514
                                                                                                                                                                                                                        • Instruction ID: 1cbbd36348c41b3311386e0b9d0a20f1b1c4d21bf7d9573915b1ba99331fb76a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 87f7b0a5de183da02882c39e40a9c5277c9a1d09e12685698913540847143514
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C7221775A083418FC714CF18C48062ABBF1FF88714F198A2EE999A7391D775E941CF8A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00408F20 Relevance: 3.0, APIs: 2, Instructions: 26COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2295610775-0
                                                                                                                                                                                                                        • Opcode ID: d88965ee97bb4822c6f5735e6fb7c0daf0eae884ec34d0cf24b004702f191101
                                                                                                                                                                                                                        • Instruction ID: 704cf8f4e32a680898036105631b38574d231553fb3af9f17300ce401ba249f6
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d88965ee97bb4822c6f5735e6fb7c0daf0eae884ec34d0cf24b004702f191101
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6CF0DA745183418BE710EFB4D54C31EBBE0BB84318F544E2DE8A9922E0E7BD8558CB87
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004095E6 Relevance: .3, Instructions: 282COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: ad0a953a7912c998d8460aa3cbf0d34e957a404584fcef4e55bd5703657de69d
                                                                                                                                                                                                                        • Instruction ID: 0c18a3eff60174cb18f533cfcdf03bd16056950eb2d79401b90b41b69f56c1f0
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ad0a953a7912c998d8460aa3cbf0d34e957a404584fcef4e55bd5703657de69d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 93B1B231A142648FC708EF2ED89416AB7F1EBC9311F068A7EE685D3391D335E906CB58
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00409949 Relevance: .2, Instructions: 156COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: c935b049c362aa1a63225b768a6dbc6fca87cb99015741649604f348b5fa66f8
                                                                                                                                                                                                                        • Instruction ID: 2bdbe780b9e1ae2383d83eb5e7904df0d3d9205a4af587aec09da948086b2981
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c935b049c362aa1a63225b768a6dbc6fca87cb99015741649604f348b5fa66f8
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: EC51C3717241604BCB08EE3EDCA4176B7E2E7C6302B5586BEE682C3795C739D902C758
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004025E0 Relevance: 47.5, APIs: 20, Strings: 7, Instructions: 234windowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: MessageSend$Create$Window$BaseClientDialogFontIconIndirectInfoLoadMetricParametersRectSystemUnits
                                                                                                                                                                                                                        • String ID: $0$BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
                                                                                                                                                                                                                        • API String ID: 3223904152-2569830377
                                                                                                                                                                                                                        • Opcode ID: 7943c390b9244dced28919df85ac531d04cee13212c8fd2bffe6eea2c2ad8852
                                                                                                                                                                                                                        • Instruction ID: 2067da98e2504e100063f8f35cc28d01e2b4b69eff652bc710e7bd6244d7957c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7943c390b9244dced28919df85ac531d04cee13212c8fd2bffe6eea2c2ad8852
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B7C183B4909301DFE700EF68C19835ABFE0FB88354F10896EE8988B355D7B99548CF96
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00403880 Relevance: 33.5, APIs: 6, Strings: 13, Instructions: 262COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: free
                                                                                                                                                                                                                        • String ID: %s%c%s.py$Absolute path to script exceeds PATH_MAX$Could not get __main__ module's dict.$Could not get __main__ module.$Failed to unmarshal code object for %s$Traceback is disabled via bootloader option.$\$__file__$__main__$_pyi_main_co$format_exception$pyi-disable-windowed-traceback$traceback
                                                                                                                                                                                                                        • API String ID: 1294909896-4198433784
                                                                                                                                                                                                                        • Opcode ID: 15c4208f2d8e130932219e82c4b0b5fb2b9fa64d0c384d1944226fe3b7cf001d
                                                                                                                                                                                                                        • Instruction ID: 6540644356b1fe9e7dd3889ac2da6173512776e99aae4954ed64b62622b12aad
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 15c4208f2d8e130932219e82c4b0b5fb2b9fa64d0c384d1944226fe3b7cf001d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 35B1C4B4608701DFC710AF29D58815ABBE4BF88355F41892EE9D9D3390DBB8C981CF5A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00405A60 Relevance: 28.6, APIs: 2, Strings: 17, Instructions: 132COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 00407650: GetEnvironmentVariableW.KERNEL32(00000000,00403DEA), ref: 0040768F
                                                                                                                                                                                                                        • free.MSVCRT ref: 00405C26
                                                                                                                                                                                                                        • free.MSVCRT ref: 00405C34
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: free$EnvironmentVariable
                                                                                                                                                                                                                        • String ID: 0$ 0$%s%c%s%c%s%c%s%c%s$;$;$Error detected starting Python VM.$Failed to convert argv to wchar_t$Failed to convert progname to wchar_t$Failed to convert pyhome to wchar_t$Failed to convert pypath to wchar_t$Invalid value for PYTHONUTF8=%s; disabling utf-8 mode!$PYTHONUTF8$\$\$base_library.zip$lib-dynload$sys.path (based on %s) exceeds buffer[%d] space
                                                                                                                                                                                                                        • API String ID: 471908985-4092346810
                                                                                                                                                                                                                        • Opcode ID: d52d000c1473065b0899b1ed74f52dc053d7693a20c2f5cf1e11e3dc0598f350
                                                                                                                                                                                                                        • Instruction ID: 22c84da25320057bd24c90e3ec615a054902b22b929e7a825a46e5f77c0d8298
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d52d000c1473065b0899b1ed74f52dc053d7693a20c2f5cf1e11e3dc0598f350
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B5513BB0609B009BE310AF65D54826BBBE0EF44354F458A2FE9D5A72D1C7BC8485CF9B
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040E660 Relevance: 25.7, APIs: 17, Instructions: 174COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: setlocale$wcstombs$_strdupfreerealloc
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2293806352-0
                                                                                                                                                                                                                        • Opcode ID: 9dd92505955bcef7c0158eea0a81386eeefa2c3a7dcaf571075d4c2b4108fbf2
                                                                                                                                                                                                                        • Instruction ID: 1138b9a49e69c7a07146da18e6cbb8f4c5af7b9e580f31b8634df38c7834fdfb
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9dd92505955bcef7c0158eea0a81386eeefa2c3a7dcaf571075d4c2b4108fbf2
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 036130709082119BCB10AF66C44536FBBE1EF94344F468D3FE488A7391E77C8891DB9A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00402B80 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 81windowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: _wcsdupfree$DeleteDestroyDialogHandleIconIndirectModuleObjectParammemset
                                                                                                                                                                                                                        • String ID: 8 $@$Unhandled exception in script
                                                                                                                                                                                                                        • API String ID: 3963799495-1206599369
                                                                                                                                                                                                                        • Opcode ID: 47d42c7bf4735e15dde57d63418aef27060c31eb55eeab7a34c0ce7b6333cf64
                                                                                                                                                                                                                        • Instruction ID: 5f7a7bfca591e00baa7cae047d41d3b5615dab244da7dd9e67f68e2e3487ae70
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 47d42c7bf4735e15dde57d63418aef27060c31eb55eeab7a34c0ce7b6333cf64
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C231E5B05087409FD750EF69D48969FBBE4AF89348F428D2EE58897350DB78D488CB86
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004077C0 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 101COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                                                                                                                                                                                                        • ExpandEnvironmentStringsW.KERNEL32(?,00000000,?,?,0040797A,?,00000000,?,?,00407B92), ref: 0040780C
                                                                                                                                                                                                                        • free.MSVCRT ref: 0040781A
                                                                                                                                                                                                                          • Part of subcall function 00408FA0: wcslen.MSVCRT ref: 00408FAC
                                                                                                                                                                                                                        • _wfullpath.MSVCRT ref: 0040784A
                                                                                                                                                                                                                        • wcschr.MSVCRT ref: 00407877
                                                                                                                                                                                                                        • wcsncpy.MSVCRT ref: 004078A7
                                                                                                                                                                                                                        • CreateDirectoryW.KERNEL32 ref: 004078B7
                                                                                                                                                                                                                        • wcschr.MSVCRT ref: 004078C7
                                                                                                                                                                                                                        • CreateDirectoryW.KERNEL32 ref: 004078DD
                                                                                                                                                                                                                        • _wcsdup.MSVCRT ref: 004078F3
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 0040792E
                                                                                                                                                                                                                        • LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00407920
                                                                                                                                                                                                                        • LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00407900
                                                                                                                                                                                                                        • \, xrefs: 004078BF
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CreateDirectorywcschr$ByteCharEnvironmentExpandMultiStringsWide_wcsdup_wfullpathfreewcslenwcsncpy
                                                                                                                                                                                                                        • String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.$\
                                                                                                                                                                                                                        • API String ID: 274989731-3296995943
                                                                                                                                                                                                                        • Opcode ID: f389d4807b938e55ecb376f0f53028c8ff9e65046959c3115b4ca1d10331afd9
                                                                                                                                                                                                                        • Instruction ID: b23a07802ca04ce963d90eb9615f597fb6c60bb1e29e7f7f3b36ce21c54aa4ff
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f389d4807b938e55ecb376f0f53028c8ff9e65046959c3115b4ca1d10331afd9
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1C315DB1A087018BD3107F69D94935FBAE4BF84344F05883EE9C897381DB79D8459B8B
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00403370 Relevance: 22.7, APIs: 2, Strings: 13, Instructions: 220stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 004032F0: strchr.MSVCRT ref: 0040332F
                                                                                                                                                                                                                          • Part of subcall function 004032F0: strcpy.MSVCRT ref: 00403345
                                                                                                                                                                                                                        • strcmp.MSVCRT ref: 0040351A
                                                                                                                                                                                                                          • Part of subcall function 00407FD0: feof.MSVCRT ref: 00408033
                                                                                                                                                                                                                          • Part of subcall function 00407FD0: fread.MSVCRT ref: 00408057
                                                                                                                                                                                                                          • Part of subcall function 00407FD0: ferror.MSVCRT ref: 00408063
                                                                                                                                                                                                                          • Part of subcall function 00407FD0: clearerr.MSVCRT ref: 00408074
                                                                                                                                                                                                                          • Part of subcall function 00407FD0: fclose.MSVCRT ref: 004080B8
                                                                                                                                                                                                                          • Part of subcall function 00407FD0: fclose.MSVCRT ref: 004080C0
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: fclose$clearerrfeofferrorfreadstrchrstrcmpstrcpy
                                                                                                                                                                                                                        • String ID: %s%c%s$%s%c%s%c%s$%s%c%s%c%s%c%s$%s%c%s.exe$%s%c%s.pkg$Archive not found: %s$Archive path exceeds PATH_MAX$Failed to copy %s$Failed to extract %s$Failed to open archive %s!$\$\$\
                                                                                                                                                                                                                        • API String ID: 3546371548-4129990315
                                                                                                                                                                                                                        • Opcode ID: 2745f0228d78fa06d22c06bd4220cdf573474b19550bea2584d5a11ea4fe38bb
                                                                                                                                                                                                                        • Instruction ID: 8a7e982486c7dae7ba286fda290711f8ff69515a3f7b07f7f3724835a8bf7877
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2745f0228d78fa06d22c06bd4220cdf573474b19550bea2584d5a11ea4fe38bb
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 67A126B0508701AFC710EF26C58415FBBE8BF84755F408A2EF498A7390D778DA858F8A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00403D60 Relevance: 21.3, APIs: 6, Strings: 6, Instructions: 316stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 004021E0: calloc.MSVCRT ref: 004021F2
                                                                                                                                                                                                                          • Part of subcall function 004045D0: GetModuleFileNameW.KERNEL32(00000000,00403DA0), ref: 004045F4
                                                                                                                                                                                                                        • fclose.MSVCRT ref: 00404245
                                                                                                                                                                                                                          • Part of subcall function 00404670: strcpy.MSVCRT(?,-00000004,?,00000002,?,00401600), ref: 00404683
                                                                                                                                                                                                                          • Part of subcall function 00404670: strlen.MSVCRT ref: 0040468B
                                                                                                                                                                                                                          • Part of subcall function 00407650: GetEnvironmentVariableW.KERNEL32(00000000,00403DEA), ref: 0040768F
                                                                                                                                                                                                                        • free.MSVCRT ref: 00403E26
                                                                                                                                                                                                                          • Part of subcall function 00407770: SetEnvironmentVariableW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0040D7CA), ref: 0040779E
                                                                                                                                                                                                                          • Part of subcall function 00407770: free.MSVCRT(?,?,-00000004,?,00000002,?,00401600), ref: 004077AC
                                                                                                                                                                                                                        • SetDllDirectoryW.KERNEL32 ref: 00403EA2
                                                                                                                                                                                                                        • strcmp.MSVCRT ref: 00403EDB
                                                                                                                                                                                                                        • strcpy.MSVCRT ref: 00403F28
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: EnvironmentVariablefreestrcpy$DirectoryFileModuleNamecallocfclosestrcmpstrlen
                                                                                                                                                                                                                        • String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
                                                                                                                                                                                                                        • API String ID: 3041748488-3602715111
                                                                                                                                                                                                                        • Opcode ID: 768be83e8ff3a33b0980ba9665766b318ff6543d5b006575faa26a0d4c761c3c
                                                                                                                                                                                                                        • Instruction ID: 81834f9b1efb18d84d1230dad00edf6ea56ed27c7a1d01e0e46bb9e00272f83c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 768be83e8ff3a33b0980ba9665766b318ff6543d5b006575faa26a0d4c761c3c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0FD1F8B09097018AD710AF75D58425FBBE8AF84345F01893FE9D8A7381E738D985CF96
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00405490 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 133COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to convert Wflag %s using mbstowcs (invalid multibyte string), xrefs: 00405697
                                                                                                                                                                                                                        • pyi-, xrefs: 00405554
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: Failed to convert Wflag %s using mbstowcs (invalid multibyte string)$pyi-
                                                                                                                                                                                                                        • API String ID: 0-3625900369
                                                                                                                                                                                                                        • Opcode ID: b82ee6a41f0246c7b60d63f8347de0f5df44efc621638f2d70a5ca26f7bbdf59
                                                                                                                                                                                                                        • Instruction ID: 53111416b2da41d66908906ea93154b7d6de6c86b10f1f3900d8cec0b1898ba9
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b82ee6a41f0246c7b60d63f8347de0f5df44efc621638f2d70a5ca26f7bbdf59
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 33513CB05097009FD710AF65D98476ABBE0FB45304F82482EE8C8AB391D3BDD885CF5A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004019C0 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 141COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • malloc.MSVCRT ref: 00401A0D
                                                                                                                                                                                                                        • fread.MSVCRT ref: 00401A94
                                                                                                                                                                                                                        • free.MSVCRT(?,?,?,?,0040638C,?,?,?,?,?,?,?,?,00000000,?,004040A4), ref: 00401ACF
                                                                                                                                                                                                                        • fclose.MSVCRT ref: 00401AE5
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to extract %s: failed to open archive file!, xrefs: 00401B55
                                                                                                                                                                                                                        • fread, xrefs: 00401AB5
                                                                                                                                                                                                                        • Failed to extract %s: failed to read data chunk!, xrefs: 00401AAD
                                                                                                                                                                                                                        • Failed to extract %s: failed to seek to the entry's data!, xrefs: 00401B73
                                                                                                                                                                                                                        • malloc, xrefs: 00401BB2
                                                                                                                                                                                                                        • fseek, xrefs: 00401B7F
                                                                                                                                                                                                                        • Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00401BA7
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: fclosefreadfreemalloc
                                                                                                                                                                                                                        • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                        • API String ID: 3295367466-3659356012
                                                                                                                                                                                                                        • Opcode ID: 8884fdb84953ef4ecbf5526515473dd84cde1690139ba998021ef6e9a9ea1245
                                                                                                                                                                                                                        • Instruction ID: c4bf1cbcbd5ed2c421977dfe96b942ab9f05e938e4513c73373e5f6d25da3068
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8884fdb84953ef4ecbf5526515473dd84cde1690139ba998021ef6e9a9ea1245
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A25103B16093019FD700EF2AD49461BBBE4AF85744F05882EF988DB351E779D885CF8A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00405907 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 88COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • out of memory, xrefs: 00405A3A
                                                                                                                                                                                                                        • Fatal error: unable to decode the command line argument #%i, xrefs: 004059EB
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: free$setlocale$_strdupcalloc
                                                                                                                                                                                                                        • String ID: Fatal error: unable to decode the command line argument #%i$out of memory
                                                                                                                                                                                                                        • API String ID: 3058678114-3355598041
                                                                                                                                                                                                                        • Opcode ID: 8e491d779bcae0e2072a8594eb7feea33e39b682cb57c9099b2df8bd6e9feec6
                                                                                                                                                                                                                        • Instruction ID: 3c8cf5d1830a856620667b4546970957c4b2e71bcab9539e8d8fe080ce2f005d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8e491d779bcae0e2072a8594eb7feea33e39b682cb57c9099b2df8bd6e9feec6
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BD313AB16087118FD710AF69E58526FBBE0EF40318F06482EE9C497341E77DD885CB9A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00405C49 Relevance: 18.1, APIs: 2, Strings: 10, Instructions: 88COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                                                                                                                                                                                                          • Part of subcall function 00408C20: calloc.MSVCRT ref: 00408C3D
                                                                                                                                                                                                                          • Part of subcall function 00408C20: free.MSVCRT ref: 00408C88
                                                                                                                                                                                                                          • Part of subcall function 00408C20: free.MSVCRT ref: 00408C96
                                                                                                                                                                                                                        • free.MSVCRT ref: 00405C26
                                                                                                                                                                                                                        • free.MSVCRT ref: 00405C34
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: free$ByteCharMultiWidecalloc
                                                                                                                                                                                                                        • String ID: 0$ 0$%s%c%s%c%s%c%s%c%s$;$;$Invalid value for PYTHONUTF8=%s; disabling utf-8 mode!$\$\$base_library.zip$lib-dynload
                                                                                                                                                                                                                        • API String ID: 3975185072-2560864920
                                                                                                                                                                                                                        • Opcode ID: adbe956365aedb5869d1d07a265270035179c80d4643125045a902af79938b7f
                                                                                                                                                                                                                        • Instruction ID: 4f34d637e5975f622271dbaeae991fb6a0a455f2055f84ceed78d6860252850e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: adbe956365aedb5869d1d07a265270035179c80d4643125045a902af79938b7f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: EF414AB0609711DFE310AF21E94825BBBE4FF48344F41882EE9C997390D7B89586CF5A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00402370 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 145COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                                                                                                                                                                        • String ID: P%
                                                                                                                                                                                                                        • API String ID: 2147705588-2959514604
                                                                                                                                                                                                                        • Opcode ID: 4779583b6165d53cbf8f2ebd436e25e3f78b969fa8961c87bf186bca652e6f9b
                                                                                                                                                                                                                        • Instruction ID: ab84631f0651d0ee5a96381c4044ee0ed1be7ca295fb525e9842aa76770568ef
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4779583b6165d53cbf8f2ebd436e25e3f78b969fa8961c87bf186bca652e6f9b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: FE51F8B19083108FC714EF29D58826ABBF0BF88711F45897EFC898B356E7788544DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040D980 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 129fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • VirtualProtect failed with code 0x%x, xrefs: 0040DAE6
                                                                                                                                                                                                                        • Mingw-w64 runtime failure:, xrefs: 0040D9A8
                                                                                                                                                                                                                        • VirtualQuery failed for %d bytes at address %p, xrefs: 0040DB17
                                                                                                                                                                                                                        • Address %p has no image-section, xrefs: 0040DB2B
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: QueryVirtualabortfwritevfprintf
                                                                                                                                                                                                                        • String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
                                                                                                                                                                                                                        • API String ID: 2513968241-1534286854
                                                                                                                                                                                                                        • Opcode ID: 5c2ecd956853b343dac6192357bd0367a738e9911806a7d503f452befc2f41a7
                                                                                                                                                                                                                        • Instruction ID: 12c366034f147c51322be65863a430c13289ac5cb36f6d5ee6a9828dd919d681
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5c2ecd956853b343dac6192357bd0367a738e9911806a7d503f452befc2f41a7
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C7514EB19083018FC710EF69D88565BFBF0FF84354F45896EE88997255E738E844CB9A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004061B0 Relevance: 16.6, APIs: 10, Strings: 1, Instructions: 143stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Cannot allocate memory for necessary files., xrefs: 0040639F
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: memcpystrncpy$malloc$callocfreestrlenstrncat
                                                                                                                                                                                                                        • String ID: Cannot allocate memory for necessary files.
                                                                                                                                                                                                                        • API String ID: 1441568290-2795144771
                                                                                                                                                                                                                        • Opcode ID: 7c9ef0ba816273b896b145fc103824cdb55597e19d7904a55412be52107c55ef
                                                                                                                                                                                                                        • Instruction ID: 3dc4d87da5770e9ddebe32c392722ba7e048c8290a166a4e568edb3e8c8cc1ad
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7c9ef0ba816273b896b145fc103824cdb55597e19d7904a55412be52107c55ef
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F35105B16093018FC714EF65C08469ABBE4FF88314F12892EE9C997351E778E588CB86
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00406410 Relevance: 16.6, APIs: 9, Strings: 2, Instructions: 140stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • SPLASH: Cannot extract requirement %s., xrefs: 00406629
                                                                                                                                                                                                                        • SPLASH: Cannot find requirement %s in archive., xrefs: 0040653D
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: strlenstrncpy$callocfreememcpystrcmp
                                                                                                                                                                                                                        • String ID: SPLASH: Cannot extract requirement %s.$SPLASH: Cannot find requirement %s in archive.
                                                                                                                                                                                                                        • API String ID: 1148940474-4094522769
                                                                                                                                                                                                                        • Opcode ID: 0fe46789b0fddc5af01da26119ed087f378fa1ebee96805bf033b37bb594d0e1
                                                                                                                                                                                                                        • Instruction ID: eeb11d6563064941a90a30efff23fdfd712fb47c201b2447917d1c532d445a23
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0fe46789b0fddc5af01da26119ed087f378fa1ebee96805bf033b37bb594d0e1
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8B51E4B05097059FC324EF25D58529FFBE0BF84744F02882EEAC997352D7789884DB96
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00405AA1 Relevance: 16.6, APIs: 2, Strings: 9, Instructions: 86COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: free
                                                                                                                                                                                                                        • String ID: 0$ 0$%s%c%s%c%s%c%s%c%s$;$;$\$\$base_library.zip$lib-dynload
                                                                                                                                                                                                                        • API String ID: 1294909896-729638271
                                                                                                                                                                                                                        • Opcode ID: ef64446728c2080087c71a493b58b8590e796b5ae5cde7a7036147615cfb8823
                                                                                                                                                                                                                        • Instruction ID: 1f7a57bb88f92124875474453c602a743d3be9c2356b80e19fcfa62188903238
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ef64446728c2080087c71a493b58b8590e796b5ae5cde7a7036147615cfb8823
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A74139B06097109FE310AF20E94825BBBE0FF44344F81882EE9C997390D7B89485CF5A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00407FD0 Relevance: 15.1, APIs: 10, Instructions: 77fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 004046B0: _wfopen.MSVCRT ref: 00404703
                                                                                                                                                                                                                          • Part of subcall function 00407DD0: strlen.MSVCRT ref: 00407E4A
                                                                                                                                                                                                                          • Part of subcall function 00407DD0: strtok.MSVCRT ref: 00407E5C
                                                                                                                                                                                                                          • Part of subcall function 00407DD0: strlen.MSVCRT ref: 00407E7B
                                                                                                                                                                                                                          • Part of subcall function 00407DD0: strlen.MSVCRT ref: 00407E8F
                                                                                                                                                                                                                          • Part of subcall function 00407DD0: strcpy.MSVCRT(?,?,00000000), ref: 00407EA3
                                                                                                                                                                                                                          • Part of subcall function 00407DD0: strtok.MSVCRT ref: 00407EB7
                                                                                                                                                                                                                          • Part of subcall function 00407DD0: _wstat.MSVCRT ref: 00407EE1
                                                                                                                                                                                                                        • feof.MSVCRT ref: 00408033
                                                                                                                                                                                                                        • fread.MSVCRT ref: 00408057
                                                                                                                                                                                                                        • ferror.MSVCRT ref: 00408063
                                                                                                                                                                                                                        • clearerr.MSVCRT ref: 00408074
                                                                                                                                                                                                                        • fwrite.MSVCRT ref: 00408093
                                                                                                                                                                                                                        • ferror.MSVCRT ref: 0040809F
                                                                                                                                                                                                                        • clearerr.MSVCRT ref: 004080B0
                                                                                                                                                                                                                        • fclose.MSVCRT ref: 004080B8
                                                                                                                                                                                                                        • fclose.MSVCRT ref: 004080C0
                                                                                                                                                                                                                        • fclose.MSVCRT ref: 004080E3
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: fclosestrlen$clearerrferrorstrtok$_wfopen_wstatfeoffreadfwritestrcpy
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3104166669-0
                                                                                                                                                                                                                        • Opcode ID: 5129a295bf3d7465ed589c74a8b46aec7613a5adb7438a7249500ed6fb567e41
                                                                                                                                                                                                                        • Instruction ID: e6213c5d7688b8fe1ba8341ac8fdb9db29b335e178dc78efa11f235658ae9a09
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5129a295bf3d7465ed589c74a8b46aec7613a5adb7438a7249500ed6fb567e41
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6C2110716087518AD7107F2696812AFB6E4AF84354F07493FE8D4A73C1DB7DC889CB8A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00411E60 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 127COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: %*.*s$%-*.*s$%.*s
                                                                                                                                                                                                                        • API String ID: 0-4054516066
                                                                                                                                                                                                                        • Opcode ID: f3ac9e74d6ea6427b37e06dd8f71590da5508e7645840674976c8b3a356ca51e
                                                                                                                                                                                                                        • Instruction ID: 34a7cfded508d75713a3901c6ba7bdf4e42489cc40e2d4f26330675e440d4311
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f3ac9e74d6ea6427b37e06dd8f71590da5508e7645840674976c8b3a356ca51e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D74140B16047018BDB148F28C5C5696B7E1BF84354F25866EEE898F36AD339D8C2CB49
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00408810 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 66COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00408CF4), ref: 0040885C
                                                                                                                                                                                                                        • calloc.MSVCRT ref: 00408875
                                                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32 ref: 004088B7
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ByteCharMultiWide$calloc
                                                                                                                                                                                                                        • String ID: Failed to encode filename as ANSI.$Failed to get ANSI buffer size.$Out of memory.$WideCharToMultiByte$win32_wcs_to_mbs
                                                                                                                                                                                                                        • API String ID: 1374691127-3831141058
                                                                                                                                                                                                                        • Opcode ID: 4e764323b5da6069393867320cfaeab9384a8b5dfa5186b5e5608e1b5eb85b1a
                                                                                                                                                                                                                        • Instruction ID: 5afcbffd29298bee6e331de86764b825c866944575c44242363fe351b07975aa
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4e764323b5da6069393867320cfaeab9384a8b5dfa5186b5e5608e1b5eb85b1a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8521F5B15093059FD310AF66D64835BBBE4EB90358F00892EE4D85B281DBB984889BDB
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00408920 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 64COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000), ref: 00408970
                                                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000), ref: 004089D1
                                                                                                                                                                                                                        • calloc.MSVCRT ref: 004089EA
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ByteCharMultiWide$calloc
                                                                                                                                                                                                                        • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                                                                                                                        • API String ID: 1374691127-27947307
                                                                                                                                                                                                                        • Opcode ID: ec57b2630a86b51e236bb9ae246de2d1d3647b443b0b6df9a08948982de9e88b
                                                                                                                                                                                                                        • Instruction ID: 392d32d0dc93c970adbdd4bd206061dd84090e66cdb548403919dc1ed5805d2f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ec57b2630a86b51e236bb9ae246de2d1d3647b443b0b6df9a08948982de9e88b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B021E7B01093028BD310AF66D55831BBAE4EF94758F00892EE4E4572D0D7B9D989DB97
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00408374 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 61stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • LOADER: failed to allocate argv_pyi: %s, xrefs: 0040842D
                                                                                                                                                                                                                        • LOADER: failed to strdup argv[%d]: %s, xrefs: 0040840A
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: _errnostrerror$_strdupcalloc
                                                                                                                                                                                                                        • String ID: LOADER: failed to allocate argv_pyi: %s$LOADER: failed to strdup argv[%d]: %s
                                                                                                                                                                                                                        • API String ID: 4278403329-2782260415
                                                                                                                                                                                                                        • Opcode ID: 862b9698239ebce43a11a1cd65b9d3759b7cedee0f2de4c3e769b3fa45a04455
                                                                                                                                                                                                                        • Instruction ID: 75a4103835d43aa6c95cb7ec3b6db505b02a0d5b0f758bc2d410c1ae15a23f9c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 862b9698239ebce43a11a1cd65b9d3759b7cedee0f2de4c3e769b3fa45a04455
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0A2179B4904711CFC720AF75D94419ABBE0EB45314F514A7EE894A33A1E739E881CB9A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004055C3 Relevance: 13.5, APIs: 9, Instructions: 49COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: setbuf$_fileno_setmodefflush
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1650367497-0
                                                                                                                                                                                                                        • Opcode ID: 7a9e4e7938dbc5579c4c6519335179e61544e4fd34365661340af95d00fc0a84
                                                                                                                                                                                                                        • Instruction ID: 4513b405083115c81ca635af3cf8f4969db3efee2aa6dccd88a9e4f4ed2810d7
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7a9e4e7938dbc5579c4c6519335179e61544e4fd34365661340af95d00fc0a84
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CB1120B15097108BD7007FB5D59936EBBE0BF45314F83481DD4C897241EBBD94848B9A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040DE30 Relevance: 12.1, APIs: 8, Instructions: 90COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: signal
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1946981877-0
                                                                                                                                                                                                                        • Opcode ID: 2b651e1b467f7154d26db624bfdf5758aeaee69f22ed160fdee85f15cbcdd14c
                                                                                                                                                                                                                        • Instruction ID: 529314676596798a44e2e7d48aea7ed491276213eefa766ee39382917f2d3c55
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2b651e1b467f7154d26db624bfdf5758aeaee69f22ed160fdee85f15cbcdd14c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: DD3103B09056018AD7206FB8C84432F76D0AF55728F128A2FE4E5DB3D1DB7DD888979B
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00407BC0 Relevance: 12.1, APIs: 8, Instructions: 68COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                                                                                                                                                                                                        • wcscpy.MSVCRT ref: 00407C07
                                                                                                                                                                                                                        • wcslen.MSVCRT ref: 00407C0F
                                                                                                                                                                                                                        • wcscat.MSVCRT ref: 00407C39
                                                                                                                                                                                                                        • _wfindfirst.MSVCRT ref: 00407C4C
                                                                                                                                                                                                                        • _wrmdir.MSVCRT ref: 00407C68
                                                                                                                                                                                                                        • wcscat.MSVCRT ref: 00407CDE
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: wcscat$ByteCharMultiWide_wfindfirst_wrmdirwcscpywcslen
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 955055573-0
                                                                                                                                                                                                                        • Opcode ID: 802cfa8735c993ec09b655bbe795d2bd26a3e6085fba014a598c9f678fc7b595
                                                                                                                                                                                                                        • Instruction ID: 812287d127834224555eaebaea1a5f31319f6ec07a572a1decaabcd838263556
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 802cfa8735c993ec09b655bbe795d2bd26a3e6085fba014a598c9f678fc7b595
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 572117B490D3049BD720AF75D88869EBBE4FB84304F118C3EE9C993251E7389585DB9B
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00408B00 Relevance: 12.1, APIs: 3, Strings: 5, Instructions: 60COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B91
                                                                                                                                                                                                                        • calloc.MSVCRT ref: 00408BAA
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ByteCharMultiWide$calloc
                                                                                                                                                                                                                        • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                                                                                                                                                                        • API String ID: 1374691127-876015163
                                                                                                                                                                                                                        • Opcode ID: 49be66ffc8d7871a7cc8f30d3a32206120fe137de5c71585d33270cfb99dfb38
                                                                                                                                                                                                                        • Instruction ID: 686223d8df53a97fa17e1b733178636a5c74384edd7780f85d5042dc75bc6c3c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 49be66ffc8d7871a7cc8f30d3a32206120fe137de5c71585d33270cfb99dfb38
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: AD2118B05083059FD310AF65C64925ABBF4EB84754F04893EE5E8572C1DBB8D8449B9B
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004124D0 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 406COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: fputwc$memset
                                                                                                                                                                                                                        • String ID: 0$o
                                                                                                                                                                                                                        • API String ID: 822753988-4157579757
                                                                                                                                                                                                                        • Opcode ID: c0d80a03fa09052c1a669441533165b430e64d4749c6fff7dd3072524ed2086e
                                                                                                                                                                                                                        • Instruction ID: b65a98287eddb54592c783ac7525ef4ab93ad80493cd3b98cbaa9a691208da40
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c0d80a03fa09052c1a669441533165b430e64d4749c6fff7dd3072524ed2086e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 79F16F71E102198FDB14CF68C6942DEBBF1BF44310F15822AE865EB385D778E892CB94
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040F730 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 404COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: fputc$memset
                                                                                                                                                                                                                        • String ID: 0$o
                                                                                                                                                                                                                        • API String ID: 2944404495-4157579757
                                                                                                                                                                                                                        • Opcode ID: 62ce1c91e6c4f14205547f0573e4b3f914893ff815fa095c8c03e974051d489c
                                                                                                                                                                                                                        • Instruction ID: 9062061d76251826460344fe4ffb90a7e4f33a362718e540e131347e649c7f22
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 62ce1c91e6c4f14205547f0573e4b3f914893ff815fa095c8c03e974051d489c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2BF14D72E002199FDB24DF68D49069EBBB1BF84310F15817AE859BB785D338E946CF84
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00406A75 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 138COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: free
                                                                                                                                                                                                                        • String ID: _image_data$exit$rename ::source ::_source$source$tclInit$tcl_findLibrary
                                                                                                                                                                                                                        • API String ID: 1294909896-1126984729
                                                                                                                                                                                                                        • Opcode ID: b3db61e08089af8a0f48b7dd3434c65c66f42e085b044ee94ceec25c32d68ff5
                                                                                                                                                                                                                        • Instruction ID: 5837fc7092d7bfd19bff1a36fcf45920a7a04ffe6dc7564dff579a9c2d03099d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b3db61e08089af8a0f48b7dd3434c65c66f42e085b044ee94ceec25c32d68ff5
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3A61F9B8609301CFD710AF64D48821ABBF0FF49344F81897DE9859B350D7B99859CF2A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00411A40 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 111COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: %-*.*S$%.*S
                                                                                                                                                                                                                        • API String ID: 0-812388239
                                                                                                                                                                                                                        • Opcode ID: d3ea50cc3d132d3143849def37d31036af112e818d385dd3d02cc72e2dcc9aec
                                                                                                                                                                                                                        • Instruction ID: c23151172c0a1ec719629ee0893607804d1b15add0b79fb5692203c1bf32c755
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d3ea50cc3d132d3143849def37d31036af112e818d385dd3d02cc72e2dcc9aec
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7D4196B1A097159BC7109F29D4812DEBBE0AF84794F14C52FE5488B361E33DD9C1CB8A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00405CF0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 72stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: freestrlen
                                                                                                                                                                                                                        • String ID: Failed to get _MEIPASS as PyObject.$Module object for %s is NULL!$_MEIPASS$strict$utf-8
                                                                                                                                                                                                                        • API String ID: 322734593-985300917
                                                                                                                                                                                                                        • Opcode ID: 6a5a0fc19d408c57ccd74b2a843a6cf11713645823d17a702bec6b19c546019a
                                                                                                                                                                                                                        • Instruction ID: b798077ea826a97b31ed519bc33854408a60d385b89e575b30205180b7c9f22a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6a5a0fc19d408c57ccd74b2a843a6cf11713645823d17a702bec6b19c546019a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 692117B0219B009BC7207F25D98856BBBE4FE80750F45892FE4C997291D7789482DF6B
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040E9C1 Relevance: 10.6, APIs: 7, Instructions: 71COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: freembstowcssetlocalewcstombs$realloc
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2323685431-0
                                                                                                                                                                                                                        • Opcode ID: 45279616c9b6d3ccdbfd2aaa52830abb573ecc6ee843925474a723046d140ec2
                                                                                                                                                                                                                        • Instruction ID: 0ece9848e1b9cb63aa0c7ac93180fa40d32587a4740361e1b5221defc5654884
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 45279616c9b6d3ccdbfd2aaa52830abb573ecc6ee843925474a723046d140ec2
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BA3129B09083159ECB10AF66C1452AEFBF0FF48344F51882FE888A7350E7789995CB86
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00403446 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 58stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: strcmp
                                                                                                                                                                                                                        • String ID: %s%c%s%c%s%c%s$%s%c%s.pkg$Failed to extract %s$\$\$\
                                                                                                                                                                                                                        • API String ID: 1004003707-2076181140
                                                                                                                                                                                                                        • Opcode ID: d8422f4b8ab908e08704c80b1f056dfc79cd756015d3aaecdf5715272ff86ff7
                                                                                                                                                                                                                        • Instruction ID: 73055d119674c1d8bf47e55e1769eeb00a0baa58503b6758db3226280ebf56de
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d8422f4b8ab908e08704c80b1f056dfc79cd756015d3aaecdf5715272ff86ff7
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 602128B1508701ABD7109F25C54414AFBE8BF80719F418D2EE5A8A7390D378EA45CF8A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00407CF0 Relevance: 10.6, APIs: 7, Instructions: 58COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: wcscmp$wcscat
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 545343207-0
                                                                                                                                                                                                                        • Opcode ID: ae46feb38f9d982e05331aa8471f37b1e1520206203c39296f539e6903441e66
                                                                                                                                                                                                                        • Instruction ID: 66d593373b9ba32e9ef8b9ba0102b03e4299b10aa04248f83024a0eb22297dfe
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ae46feb38f9d982e05331aa8471f37b1e1520206203c39296f539e6903441e66
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B5113DB140C7458AD710BF2599842AFBAE4AF50344F02583EE9C597245EB7CA4868B9B
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00405E00 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 56stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: strlen
                                                                                                                                                                                                                        • String ID: %U?%llu$Failed to append to sys.path$Installing PYZ: Could not get sys.path$path$strict$utf-8
                                                                                                                                                                                                                        • API String ID: 39653677-2762566162
                                                                                                                                                                                                                        • Opcode ID: 0a30e1c31abfe84ab274ddb6d250ee1ed9747d53d1c92cc8e44e52a44ddb55f5
                                                                                                                                                                                                                        • Instruction ID: 2414ad3c8f8d3fc0fbc978f46c10fd6a42ce83d48acf707811ed1e666cf8afaa
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0a30e1c31abfe84ab274ddb6d250ee1ed9747d53d1c92cc8e44e52a44ddb55f5
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6A112EB05093009FC710AF69DA8801EBBE4FF84354F45882EE5D897341D7B88481CF9B
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00417510 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryloaderCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AddressProc$HandleModule
                                                                                                                                                                                                                        • String ID: ___lc_codepage_func$__lc_codepage$msvcrt.dll
                                                                                                                                                                                                                        • API String ID: 667068680-1145701848
                                                                                                                                                                                                                        • Opcode ID: d189fa9efd416f18abebd0a9be443f761bdc61810749ea753c76760930122cfc
                                                                                                                                                                                                                        • Instruction ID: 1b2e568be5773464d0952ec9ee83d8ba760180256f55db537a2820630d2abbb3
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d189fa9efd416f18abebd0a9be443f761bdc61810749ea753c76760930122cfc
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E1F049B0848204ABD700AF38AD4418A7EF0AA08314F15863FC889C7210E778D888CBAA
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040ED40 Relevance: 9.2, APIs: 6, Instructions: 158stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: _stat$freemallocmemcpystrlen
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2821670080-0
                                                                                                                                                                                                                        • Opcode ID: 2e2927e48dad086f7b6652f0e1c13a34fbe12bb134b6987c2c9234558f53e84a
                                                                                                                                                                                                                        • Instruction ID: c5bd95b142fc711015b6ce962a46217c3aa773e4d5f7f4cf9c825846a95b2092
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2e2927e48dad086f7b6652f0e1c13a34fbe12bb134b6987c2c9234558f53e84a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5B5173715093058FC724DF2AC08026BBBE2AF89304F454D6FE8E49B385D339D956DB8A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040FCE0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 307COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: 0
                                                                                                                                                                                                                        • API String ID: 0-4108050209
                                                                                                                                                                                                                        • Opcode ID: 85bd0f672ddd99df0f0a2a81c69a256e0952087e2de33095cd5bd9eaf017051c
                                                                                                                                                                                                                        • Instruction ID: 433f201fbec311e4d545196cfb57db08f817b2de0d536de69a62510c51185dfe
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 85bd0f672ddd99df0f0a2a81c69a256e0952087e2de33095cd5bd9eaf017051c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 46C15D71A042058FDB24CF68C48079EBBF1BF89354F18817AE849AB796D339EC45CB95
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00412A90 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 294COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: 0
                                                                                                                                                                                                                        • API String ID: 0-4108050209
                                                                                                                                                                                                                        • Opcode ID: 7adf794be4c6c9f156d55b57fe4938e6437273bc955ed6dda0050f882a06c093
                                                                                                                                                                                                                        • Instruction ID: 5dacb983aef9c9090e06cba1bb9e4627a9a1d687151f3e630a54116cb97c77b1
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7adf794be4c6c9f156d55b57fe4938e6437273bc955ed6dda0050f882a06c093
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: ABC15C71A042058BDB14CF28C6847DEBBF1BF88340F19855AE949EB355E378EC91CB99
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00407564 Relevance: 8.8, APIs: 7, Instructions: 77stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: strlen$malloc
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3157260142-0
                                                                                                                                                                                                                        • Opcode ID: 0610461012db69685dc33115d6b204908d610f74a8049d1f7c086d9be229f820
                                                                                                                                                                                                                        • Instruction ID: 6a25df0a465119ab13b362e17adcb34b3197186f0404beced398dc7aaf439a95
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0610461012db69685dc33115d6b204908d610f74a8049d1f7c086d9be229f820
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B5217175A0A7059BC710AF6988846ABB7E0FF84750F46493EF8C497341FA39EC41C796
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00403030 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 30stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • _errno.MSVCRT ref: 00403064
                                                                                                                                                                                                                        • strerror.MSVCRT ref: 0040306F
                                                                                                                                                                                                                          • Part of subcall function 00402DF0: MessageBoxW.USER32 ref: 00402E78
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Message_errnostrerror
                                                                                                                                                                                                                        • String ID: %s%s: %s$0$Fatal error detected
                                                                                                                                                                                                                        • API String ID: 132859757-319980707
                                                                                                                                                                                                                        • Opcode ID: 75b9b436fd89f2a30938fcb7b058be5ee0d31631848f3b8384897b5255f1b178
                                                                                                                                                                                                                        • Instruction ID: e4a221d579113a631f8ff3878a8ccab0824710bde975c9094fb448246fb893e6
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 75b9b436fd89f2a30938fcb7b058be5ee0d31631848f3b8384897b5255f1b178
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 540180B4409345DFC750EF65D18464ABBE0FF88749F408C2EE4C897251EB789948DF96
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00402A70 Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: DialogLongWindow$InvalidateRect
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1200242243-0
                                                                                                                                                                                                                        • Opcode ID: 3787fa5d93e67dc4f7c943341e9a8d3195f1a3fb92f8390d8411d98647bb4722
                                                                                                                                                                                                                        • Instruction ID: 27a3fa5a97dc3583b937ce51c481d096ba8d8761c7d493d8dec02a740509071e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3787fa5d93e67dc4f7c943341e9a8d3195f1a3fb92f8390d8411d98647bb4722
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1A2160715082108FD310AF2CDA8925EBBE0FB84704F01893EF88A973D5D7B98949CB97
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004038E1 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 59COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: free
                                                                                                                                                                                                                        • String ID: %s%c%s.py$\$__file__$_pyi_main_co
                                                                                                                                                                                                                        • API String ID: 1294909896-1862493962
                                                                                                                                                                                                                        • Opcode ID: 46cf789b736286b4a61b83edaca85d21ba6631443c1c9059bb822cdedcba4429
                                                                                                                                                                                                                        • Instruction ID: c970f6cc1162f0d106d27565064d24bae80cc5d647643b18d1f9b1af61abd66d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 46cf789b736286b4a61b83edaca85d21ba6631443c1c9059bb822cdedcba4429
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 58219BB4909701EFC710AF24C18865ABFE4BF88745F41892EE8C993350E7B8D985DF4A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040EA58 Relevance: 7.5, APIs: 5, Instructions: 35COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: wcstombs$freereallocsetlocale
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3931877334-0
                                                                                                                                                                                                                        • Opcode ID: 1b61a0e1aaeda8027505282be700259d65b027cda1d85ed728b5ca162101692f
                                                                                                                                                                                                                        • Instruction ID: e696c5700d6393410b77d795bc353bc03d311abb2f38c8898df76e4b882a8a07
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1b61a0e1aaeda8027505282be700259d65b027cda1d85ed728b5ca162101692f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7C01D6B19093159FCB00AF65D64529EFBF0FF44344F12886EE488A7251E3789985CBCA
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040E887 Relevance: 7.5, APIs: 5, Instructions: 31COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: wcstombs$freereallocsetlocale
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3931877334-0
                                                                                                                                                                                                                        • Opcode ID: b9a3e2769ecb59adbd2afba563b8b068b0a70107dd94f56d983b6df17b883f0b
                                                                                                                                                                                                                        • Instruction ID: 3383cd8d3157cb3ed617c2d5b5c50993071427c57053a183d1f18b1378754ef2
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b9a3e2769ecb59adbd2afba563b8b068b0a70107dd94f56d983b6df17b883f0b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3DF0ECB19093009FCB40AF69D44529EFBE0EF84344F02CD6EE4D897211E7789895CB86
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040807B Relevance: 7.5, APIs: 5, Instructions: 26fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: clearerrfcloseferror$feoffreadfwrite
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2607417955-0
                                                                                                                                                                                                                        • Opcode ID: e23c38ce40b9de981818dbabdb75aa260bd4a35cb26f3327470fa7c9e50a8650
                                                                                                                                                                                                                        • Instruction ID: 6caf015234ffb0fe8031e1673ea91487ed83400b7f12cc8799a42872fabf3f27
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e23c38ce40b9de981818dbabdb75aa260bd4a35cb26f3327470fa7c9e50a8650
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D3E0AC71609B104AD3107F26A58116EF6E4AF80354F07492FE8E497291D77DC4C58B86
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004045D0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 35COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetModuleFileNameW.KERNEL32(00000000,00403DA0), ref: 004045F4
                                                                                                                                                                                                                          • Part of subcall function 00408920: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000), ref: 00408970
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to convert executable path to UTF-8., xrefs: 00404650
                                                                                                                                                                                                                        • GetModuleFileNameW, xrefs: 00404638
                                                                                                                                                                                                                        • Failed to get executable path., xrefs: 00404630
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ByteCharFileModuleMultiNameWide
                                                                                                                                                                                                                        • String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
                                                                                                                                                                                                                        • API String ID: 1532159127-1977442011
                                                                                                                                                                                                                        • Opcode ID: 748dc92c4a3665e52a64521ebb29f00cda33f6c131056bcfed0b1391d42d2669
                                                                                                                                                                                                                        • Instruction ID: 0d2fa86ab14f13f7fcc6e2807861f5dff99018acd92cf068427be3d6d0997f9d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 748dc92c4a3665e52a64521ebb29f00cda33f6c131056bcfed0b1391d42d2669
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7FF031B09083008BE700BF75D14925ABAE0AB94345F548C3EE8C887285E77E85989697
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00408987 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000), ref: 00408970
                                                                                                                                                                                                                          • Part of subcall function 00402F90: GetLastError.KERNEL32 ref: 00402F98
                                                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000), ref: 004089D1
                                                                                                                                                                                                                        • calloc.MSVCRT ref: 004089EA
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ByteCharMultiWide$ErrorLastcalloc
                                                                                                                                                                                                                        • String ID: Out of memory.$win32_utils_to_utf8
                                                                                                                                                                                                                        • API String ID: 2784544953-3983694475
                                                                                                                                                                                                                        • Opcode ID: 23ce19d6e8e5e968e1a14f6c08f0706b24b70b9de6d2737a880b3ae8fbfb5caf
                                                                                                                                                                                                                        • Instruction ID: 7d0191ab155d1c36bf02162991644b0c6808e0cf9adbb8e4045d17a736bf9196
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 23ce19d6e8e5e968e1a14f6c08f0706b24b70b9de6d2737a880b3ae8fbfb5caf
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5D0119B01083028FE310AF65D55835ABBE0EB80358F01893EE4E85B3D0D7B9C5498B87
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004174C8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: atoisetlocalestrchr
                                                                                                                                                                                                                        • String ID: .
                                                                                                                                                                                                                        • API String ID: 1223908000-248832578
                                                                                                                                                                                                                        • Opcode ID: 93559f69e0f89921f206570d2a278c7facffb9e7d98682812659cee062819bc8
                                                                                                                                                                                                                        • Instruction ID: 5ece903d628136d3021f03f5de1dba085c6daeff515edd77d6e3c8bfb4f9f80e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 93559f69e0f89921f206570d2a278c7facffb9e7d98682812659cee062819bc8
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 18E08CB0A087004BD7007F39C40A35BB6E2AB80308F8A882CE4CC87701F73DC8858786
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00404DA3 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 18libraryloaderCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AddressProc$ErrorLast
                                                                                                                                                                                                                        • String ID: Failed to get address for Py_UTF8Mode$GetProcAddress$Py_UTF8Mode
                                                                                                                                                                                                                        • API String ID: 4214558900-2336683375
                                                                                                                                                                                                                        • Opcode ID: ce3f0de93563fe4047d9d5d54811ed0c466457a72e603fabebd0357acd7d67ad
                                                                                                                                                                                                                        • Instruction ID: 29490028243a8bc7eb143a8c508494385d0dcc63e20c03701c217239cd601c8a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ce3f0de93563fe4047d9d5d54811ed0c466457a72e603fabebd0357acd7d67ad
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B7E0ECB18096108AC7106F39AA5519ABBE4BA4072CF018A2EE998572C0D778A985968E
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00416DF0 Relevance: 6.1, APIs: 4, Instructions: 102COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • IsDBCSLeadByteEx.KERNEL32 ref: 00416E42
                                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32 ref: 00416E85
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Byte$CharLeadMultiWide
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2561704868-0
                                                                                                                                                                                                                        • Opcode ID: 34c0aafb8afc26c9c968cb039ac2f52e38f4d15ab9367f4157b8da4b37fd940f
                                                                                                                                                                                                                        • Instruction ID: 73686868ec51103a6e9184972a812ecf3e9551738ac5fc900f4de2194f72883f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 34c0aafb8afc26c9c968cb039ac2f52e38f4d15ab9367f4157b8da4b37fd940f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6441F5B55093518FD710DF28E48429BBBE0BF86314F158A6EF89487390D77AD889CB87
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00401001 Relevance: 6.1, APIs: 4, Instructions: 60COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: __p__commode__p__fmode__set_app_type
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3338496922-0
                                                                                                                                                                                                                        • Opcode ID: c3091d54fea95446ff7c3ee7b6d7815346795e8d6a3ffecbbf37e06955004e2c
                                                                                                                                                                                                                        • Instruction ID: aeb446e45a19cd1e2d7087c0f9dd5afe65501be8eb4055b43830eca8bb231281
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c3091d54fea95446ff7c3ee7b6d7815346795e8d6a3ffecbbf37e06955004e2c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2B219370600201CBD314AF30D8667A737E1BB00348F55867ED4887BAA6D77ED8C6DB99
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004043B0 Relevance: 6.1, APIs: 4, Instructions: 54stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: strlenstrncat
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3854678441-0
                                                                                                                                                                                                                        • Opcode ID: 024b53f308501637485ded2f28a26100731e6414f1d197708657ac8333189728
                                                                                                                                                                                                                        • Instruction ID: a1bd85adc18dd833a72da197840ca80eebc8a3fb90e726dddcfc8ac31c193ccc
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 024b53f308501637485ded2f28a26100731e6414f1d197708657ac8333189728
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 431154B160C7404EE710BF2DE88935FBBD0EB85358F064DAFE5C457346D27984848B96
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00402CE0 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 50COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • free.MSVCRT ref: 00402D67
                                                                                                                                                                                                                        • free.MSVCRT ref: 00402D6F
                                                                                                                                                                                                                        • free.MSVCRT ref: 00402D77
                                                                                                                                                                                                                          • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to obtain/convert traceback!, xrefs: 00402D2F
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: free$ByteCharMultiWide
                                                                                                                                                                                                                        • String ID: Failed to obtain/convert traceback!
                                                                                                                                                                                                                        • API String ID: 3219091393-982972847
                                                                                                                                                                                                                        • Opcode ID: 052f5b771e97f46218db83959d6fe6f4ff6f8b7ba96841d2be7dde76f27d9c66
                                                                                                                                                                                                                        • Instruction ID: b1da0bbaf139879325ca28b011b54c10ba95b71f8749f1078afd24c14b703eba
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 052f5b771e97f46218db83959d6fe6f4ff6f8b7ba96841d2be7dde76f27d9c66
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 380157B16097009BD700BF6A959531FFAE4AF84744F06482EF8C897381DBB898458B9A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040E7F1 Relevance: 6.0, APIs: 4, Instructions: 40COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: wcstombs$freereallocsetlocale
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3931877334-0
                                                                                                                                                                                                                        • Opcode ID: af4a0adfe83bc6257ce74bebce9e2fbec335e63f4a836b3755766f42b92495f7
                                                                                                                                                                                                                        • Instruction ID: d41dfc4cb9d2f32e5806314ff69e05ab86441aac7deb837ed49f13012e92ac7c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: af4a0adfe83bc6257ce74bebce9e2fbec335e63f4a836b3755766f42b92495f7
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 35012971E04714DBCB109F69D44139EFBF0FF88314F12896EE499A7391D37898518B96
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040598B Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 39COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Fatal error: unable to decode the command line argument #%i, xrefs: 004059EB
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: free$setlocale
                                                                                                                                                                                                                        • String ID: Fatal error: unable to decode the command line argument #%i
                                                                                                                                                                                                                        • API String ID: 294139027-810459673
                                                                                                                                                                                                                        • Opcode ID: 9d1a7e72fccc39349e8435cb77fec3904dd9347efbe4d5a34812376667be7cae
                                                                                                                                                                                                                        • Instruction ID: f47e09dd697b96e2b59eaf830e36c8aa388eac640d0f1e900355e8c5eb1699ce
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9d1a7e72fccc39349e8435cb77fec3904dd9347efbe4d5a34812376667be7cae
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 86011DB5A047018FDB10AF69E88526ABBE0EF05314F46093EE9C4A7341D33DE8858B99
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00408B57 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 32COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                                                                                                                                                                                                          • Part of subcall function 00402F90: GetLastError.KERNEL32 ref: 00402F98
                                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B91
                                                                                                                                                                                                                        • calloc.MSVCRT ref: 00408BAA
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ByteCharMultiWide$ErrorLastcalloc
                                                                                                                                                                                                                        • String ID: Out of memory.$win32_utils_from_utf8
                                                                                                                                                                                                                        • API String ID: 2784544953-2800126769
                                                                                                                                                                                                                        • Opcode ID: faa07458aa00f100ca5af6febbccce1ab187ecf5489320c22ac0fd242ec8e11b
                                                                                                                                                                                                                        • Instruction ID: fcbae36c43b134958f39cc4fef673158ef90f98619c8ac1ec6a6b109632cf1fa
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: faa07458aa00f100ca5af6febbccce1ab187ecf5489320c22ac0fd242ec8e11b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F7F04FB01083028FD300AF25D50535AB7E0BB80354F05893EE4E85B281D779D4498B86
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00402F90 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 32COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 00402F98
                                                                                                                                                                                                                          • Part of subcall function 004086F0: FormatMessageW.KERNEL32(?,?,?,?,00402FD9), ref: 0040873F
                                                                                                                                                                                                                          • Part of subcall function 004086F0: WideCharToMultiByte.KERNEL32 ref: 00408787
                                                                                                                                                                                                                          • Part of subcall function 00402DF0: MessageBoxW.USER32 ref: 00402E78
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Message$ByteCharErrorFormatLastMultiWide
                                                                                                                                                                                                                        • String ID: %s%s: %s$0$Fatal error detected
                                                                                                                                                                                                                        • API String ID: 254840284-319980707
                                                                                                                                                                                                                        • Opcode ID: 0c3db0587474ba41661a36650c9661a93dd5b94a7b7985aca411cfd2fb9549be
                                                                                                                                                                                                                        • Instruction ID: 073ad40fe3aa3b4c51d3ea82456dca4d4efc994dc50aa159961d7af2ea3959c7
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0c3db0587474ba41661a36650c9661a93dd5b94a7b7985aca411cfd2fb9549be
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3E01C0B14093419FD320AF29D58428ABBE0BF88708F01882EE4C897251DB789988CF97
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040DB40 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 195COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Unknown pseudo relocation bit size %d., xrefs: 0040DC4C
                                                                                                                                                                                                                        • Unknown pseudo relocation protocol version %d., xrefs: 0040DDAD
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
                                                                                                                                                                                                                        • API String ID: 0-395989641
                                                                                                                                                                                                                        • Opcode ID: efeab4ecc8cf7299757ce823f27793ae6324061fd86fa164cff4e97c8fde8b6b
                                                                                                                                                                                                                        • Instruction ID: 5a79fb0c569983318be0eb92f73853d4612fcc90bcd5073555eddd72529e42a9
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: efeab4ecc8cf7299757ce823f27793ae6324061fd86fa164cff4e97c8fde8b6b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E271B175D042058BDB00DFA9D88029ABBF1FFC4344F25857AD888A7395D738A859CB8D
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004124C4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 166COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: fputwc$memset
                                                                                                                                                                                                                        • String ID: o
                                                                                                                                                                                                                        • API String ID: 822753988-252678980
                                                                                                                                                                                                                        • Opcode ID: 9fd6ffc3a2fae0cfd560b27fc0f11d1b2788c49dfba611f968ff3f0046a73d11
                                                                                                                                                                                                                        • Instruction ID: 0dfbfd20a5ff8b44feb81e2e93b8d7a761d81825f22629ca31478565f12853d3
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9fd6ffc3a2fae0cfd560b27fc0f11d1b2788c49dfba611f968ff3f0046a73d11
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5B61F572E002198FCB14CF68D5806DEBBF1AF48350F19816AE858EB385D374E9968B94
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040D8E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • _matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 0040D92F
                                                                                                                                                                                                                        • Unknown error, xrefs: 0040D8E2
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: fprintf
                                                                                                                                                                                                                        • String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                                        • API String ID: 383729395-3474627141
                                                                                                                                                                                                                        • Opcode ID: f74ba067b4a2145830e725ba5a059d72fea62b42937aab84030ba012b91b4e73
                                                                                                                                                                                                                        • Instruction ID: d090ae441ae7ed191b2c3bbd373a08a5730f8df06674ae97c57d609341765c89
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f74ba067b4a2145830e725ba5a059d72fea62b42937aab84030ba012b91b4e73
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: DD01E4B0508B85DBD300AF15E48845AFFF1FF89350F82889DF5C846269CB36D8A8C74A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00415E10 Relevance: 5.1, APIs: 4, Instructions: 55sleepCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • Sleep.KERNEL32(?,?,?,?,00415F41,?,?,?,?,?,?,00000000,004142E4), ref: 00415E37
                                                                                                                                                                                                                        • InitializeCriticalSection.KERNEL32(?,?,?,?,00415F41,?,?,?,?,?,?,00000000,004142E4), ref: 00415E74
                                                                                                                                                                                                                        • InitializeCriticalSection.KERNEL32(?,?,?,?,?,00415F41,?,?,?,?,?,?,00000000,004142E4), ref: 00415E80
                                                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(?,?,?,?,00415F41,?,?,?,?,?,?,00000000,004142E4), ref: 00415EA8
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CriticalSection$Initialize$EnterSleep
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1117354567-0
                                                                                                                                                                                                                        • Opcode ID: d7b42fd4e733c284aa8614d4c2843ab90d0827d89210ebc45ef6cd9b7a9f8079
                                                                                                                                                                                                                        • Instruction ID: 8d4cea6e3eae5d5154d2418d5b7341923ef78fd17797a7ba2a2094ec0acf5e62
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d7b42fd4e733c284aa8614d4c2843ab90d0827d89210ebc45ef6cd9b7a9f8079
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: FC113771804604CBDB65AB2CE9D51EF37A4F740300F652636D445C7324E779D9C8C69E
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040DFE0 Relevance: 5.0, APIs: 4, Instructions: 39COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(?,?,?,?,?,?,0040E1AB,?,?,?,?,?,0040D818), ref: 0040DFEE
                                                                                                                                                                                                                        • TlsGetValue.KERNEL32(?,?,?,?,?,?,?,0040E1AB,?,?,?,?,?,0040D818), ref: 0040E015
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,0040E1AB,?,?,?,?,?,0040D818), ref: 0040E01C
                                                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,0040E1AB,?,?,?,?,?,0040D818), ref: 0040E03C
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CriticalSection$EnterErrorLastLeaveValue
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 682475483-0
                                                                                                                                                                                                                        • Opcode ID: be30760642f5f923f25c22eccc3533437ca06620e5a78a3e64c9a32c5ac432c0
                                                                                                                                                                                                                        • Instruction ID: ec43abde3d5bb8c9cd3b17ef075de6dc33701065addaa06d31121f0b361238c5
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: be30760642f5f923f25c22eccc3533437ca06620e5a78a3e64c9a32c5ac432c0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6FF028B55003118BD710BF79E8C890B7BF4EB04740F0505B9DD848B325E774AC19CBAA
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00406720 Relevance: 5.0, APIs: 4, Instructions: 29COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • free.MSVCRT(-00000004,?,00000002), ref: 0040673C
                                                                                                                                                                                                                        • free.MSVCRT(-00000004,?,00000002), ref: 0040674E
                                                                                                                                                                                                                        • free.MSVCRT(-00000004,?,00000002), ref: 00406760
                                                                                                                                                                                                                        • free.MSVCRT(-00000004,?,00000002), ref: 00406768
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.3540090259.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540037413.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540131868.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540186772.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540238086.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.3540296541.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: free
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1294909896-0
                                                                                                                                                                                                                        • Opcode ID: f1f19a07b2916ba5163eaa3879dfc33869d61147520d0c246ce0b263a20fc7fb
                                                                                                                                                                                                                        • Instruction ID: 7fa97c1622dad13d69692f5ac932c0fb64940c2aa2579b211d90da9c96ec3935
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f1f19a07b2916ba5163eaa3879dfc33869d61147520d0c246ce0b263a20fc7fb
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 34F0FEB56143004BDF20BF35B4C565A7BE4AF00748F4B087DED85AB242E738D8908B69
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Execution Graph

                                                                                                                                                                                                                        Execution Coverage:0.4%
                                                                                                                                                                                                                        Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                        Signature Coverage:0%
                                                                                                                                                                                                                        Total number of Nodes:308
                                                                                                                                                                                                                        Total number of Limit Nodes:25
                                                                                                                                                                                                                        execution_graph 53313 404300 53314 40430b 53313->53314 53321 4042d0 53314->53321 53317 40436b 53320 4042d0 3 API calls 53320->53317 53344 40f100 53321->53344 53323 4042f7 53323->53317 53324 40e900 setlocale 53323->53324 53325 40e923 _strdup 53324->53325 53326 40e92d setlocale 53324->53326 53325->53326 53327 40e950 wcstombs realloc wcstombs setlocale free 53326->53327 53328 40e948 53326->53328 53329 404348 53327->53329 53328->53327 53330 40e9c8 mbstowcs 53328->53330 53329->53320 53353 40e630 53330->53353 53333 40ea42 53335 40ea6e 53333->53335 53337 40ea80 53333->53337 53334 40ea21 53334->53333 53336 40ec55 setlocale free 53334->53336 53335->53327 53336->53329 53338 40eae1 wcstombs realloc wcstombs 53337->53338 53343 40eb70 wcstombs 53337->53343 53340 40eb4e setlocale free 53338->53340 53340->53329 53342 40ecc2 53342->53340 53343->53340 53343->53342 53345 40f150 53344->53345 53346 40f119 53344->53346 53352 411040 fputc _errno fputc 53345->53352 53351 411040 fputc _errno fputc 53346->53351 53349 40f138 53349->53323 53350 40f170 53350->53323 53351->53349 53352->53350 53354 40e63d mbstowcs 53353->53354 53354->53333 53354->53334 53355 408100 53358 408b00 53355->53358 53359 408b60 MultiByteToWideChar 53358->53359 53360 408b13 53358->53360 53362 408bf8 53359->53362 53363 408b9c calloc 53359->53363 53361 408b1d MultiByteToWideChar 53360->53361 53365 408bd8 53361->53365 53366 408121 LoadLibraryExW free 53361->53366 53373 402f90 12 API calls 53362->53373 53363->53361 53367 408bb9 53363->53367 53372 402f90 12 API calls 53365->53372 53371 402f90 12 API calls 53367->53371 53370 408bcd 53370->53366 53371->53370 53372->53366 53373->53366 53374 401e60 53375 402020 53374->53375 53376 401e75 53374->53376 53422 4046b0 53375->53422 53388 402014 53376->53388 53403 408550 malloc 53376->53403 53379 401eaa 53379->53388 53414 40ef60 53379->53414 53382 401ed4 fread 53385 402061 53382->53385 53386 401efd 53382->53386 53383 40208f 53430 403030 14 API calls 53383->53430 53429 403030 14 API calls 53385->53429 53389 40ef60 6 API calls 53386->53389 53390 401f57 malloc 53389->53390 53391 4020a5 53390->53391 53392 401f6d fread 53390->53392 53431 403030 14 API calls 53391->53431 53393 402046 53392->53393 53394 401f8f ferror 53392->53394 53428 403030 14 API calls 53393->53428 53397 40207c 53394->53397 53398 401fac 53394->53398 53399 402ed0 12 API calls 53397->53399 53402 401ff6 53398->53402 53417 402ed0 53398->53417 53399->53388 53400 402006 fclose 53400->53388 53402->53388 53402->53400 53404 408571 53403->53404 53405 4086b2 free 53403->53405 53406 40ef60 6 API calls 53404->53406 53405->53379 53408 40858d 53406->53408 53408->53405 53432 40f050 53408->53432 53410 40ef60 6 API calls 53412 4085a1 53410->53412 53411 40863f fread 53411->53405 53411->53412 53412->53405 53412->53410 53412->53411 53413 408670 memcmp 53412->53413 53413->53405 53413->53412 53437 40ef90 53414->53437 53418 40f100 3 API calls 53417->53418 53419 402f01 53418->53419 53447 402df0 53419->53447 53421 402f19 53421->53398 53423 4046bc 53422->53423 53424 408b00 12 API calls 53423->53424 53425 4046e1 53424->53425 53426 408b00 12 API calls 53425->53426 53427 4046fc _wfopen 53426->53427 53427->53376 53428->53388 53429->53388 53430->53388 53431->53388 53435 40f070 fgetpos 53432->53435 53436 40f05f 53435->53436 53436->53412 53438 40efd8 fgetpos 53437->53438 53439 40efac 53437->53439 53442 40efec 53438->53442 53446 401ecc 53438->53446 53440 40f000 fflush _fileno _filelengthi64 53439->53440 53441 40efb1 53439->53441 53445 40efc1 fsetpos 53440->53445 53443 40efb5 53441->53443 53444 40f02a _errno 53441->53444 53442->53440 53442->53445 53443->53445 53444->53446 53445->53446 53446->53382 53446->53383 53448 402dfc 53447->53448 53449 408b00 10 API calls 53448->53449 53450 402e38 53449->53450 53451 402e90 MessageBoxA 53450->53451 53452 402e3c 53450->53452 53451->53421 53453 408b00 10 API calls 53452->53453 53454 402e5e MessageBoxW 53453->53454 53454->53421 53455 4038e1 53459 4038e8 53455->53459 53457 4039e0 53459->53457 53461 403955 PyUnicode_FromString PyObject_SetAttrString Py_DecRef PyMarshal_ReadObjectFromString 53459->53461 53462 4039ed 53459->53462 53488 401980 53459->53488 53493 4019c0 53459->53493 53523 403270 53459->53523 53463 403a09 53461->53463 53464 40399c PyObject_SetAttrString PyEval_EvalCode 53461->53464 53465 402ed0 12 API calls 53462->53465 53469 402ed0 12 API calls 53463->53469 53466 4039d2 free 53464->53466 53467 403a33 PyErr_Fetch PyErr_NormalizeException PyObject_Str PyUnicode_AsUTF8 53464->53467 53468 4039f9 53465->53468 53466->53459 53471 403a89 Py_DecRef 53467->53471 53472 403a7f _strdup 53467->53472 53470 403a1d PyErr_Print 53469->53470 53526 402270 14 API calls 53471->53526 53472->53471 53474 403aa2 53475 403aac _strdup PyErr_Restore PyErr_Print 53474->53475 53476 403b3d PyImport_ImportModule 53474->53476 53527 402ce0 33 API calls 53475->53527 53478 403b68 PyObject_GetAttrString 53476->53478 53479 403c8d Py_DecRef 53476->53479 53480 403c80 Py_DecRef 53478->53480 53481 403b85 PyObject_CallFunctionObjArgs 53478->53481 53484 403c9b 53479->53484 53480->53479 53483 403bb6 9 API calls 53481->53483 53481->53484 53482 403af1 free free 53483->53484 53485 403c51 PyUnicode_AsUTF8 53483->53485 53486 403c6a Py_DecRef Py_DecRef 53484->53486 53485->53486 53487 403c60 _strdup 53485->53487 53486->53480 53487->53486 53489 4019a0 53488->53489 53490 401993 53488->53490 53491 402ed0 12 API calls 53489->53491 53490->53459 53492 4019ac 53491->53492 53492->53459 53494 401b30 53493->53494 53495 4019d9 53493->53495 53497 4046b0 13 API calls 53494->53497 53496 40ef60 6 API calls 53495->53496 53498 4019fb 53496->53498 53499 401b43 53497->53499 53500 401b70 53498->53500 53501 401a07 malloc 53498->53501 53499->53495 53502 401b51 53499->53502 53555 403030 14 API calls 53500->53555 53504 401a1e 53501->53504 53505 401b9f 53501->53505 53506 402ed0 12 API calls 53502->53506 53510 401b00 53504->53510 53511 401a2c 53504->53511 53556 403030 14 API calls 53505->53556 53507 401af0 53506->53507 53507->53459 53508 401b8b 53508->53459 53529 401610 53510->53529 53516 401adc 53511->53516 53517 401a73 fread 53511->53517 53518 401a48 53511->53518 53513 401ae2 fclose 53513->53507 53514 401b14 53515 401ac8 free 53514->53515 53514->53516 53515->53516 53516->53507 53516->53513 53517->53518 53519 401aa5 53517->53519 53518->53511 53518->53517 53520 401b20 53518->53520 53528 403030 14 API calls 53519->53528 53520->53513 53522 401b2a 53520->53522 53522->53507 53524 40f100 3 API calls 53523->53524 53525 403297 53524->53525 53525->53459 53526->53474 53527->53482 53528->53515 53557 40a4f0 53529->53557 53532 401672 malloc 53534 401688 malloc 53532->53534 53535 401919 53532->53535 53533 4018d4 53536 402ed0 12 API calls 53533->53536 53538 4018f9 53534->53538 53547 4016a4 53534->53547 53561 403030 14 API calls 53535->53561 53539 401846 53536->53539 53560 403030 14 API calls 53538->53560 53539->53514 53540 401938 53542 4016d5 fread 53544 401826 53542->53544 53545 401701 ferror 53542->53545 53543 401858 53543->53514 53546 401832 free free 53544->53546 53545->53544 53545->53547 53546->53539 53547->53542 53547->53543 53547->53544 53548 4017e9 53547->53548 53550 401770 fwrite 53547->53550 53553 40187f memcpy 53547->53553 53548->53544 53549 402ed0 12 API calls 53548->53549 53549->53544 53551 4018ca 53550->53551 53552 40179c ferror 53550->53552 53551->53548 53552->53551 53554 4017b0 53552->53554 53553->53547 53554->53547 53555->53508 53556->53516 53562 40a3f0 53557->53562 53559 401668 53559->53532 53559->53533 53560->53544 53561->53540 53563 40a405 53562->53563 53565 40a45c 53562->53565 53564 40a43d malloc 53563->53564 53563->53565 53564->53565 53565->53559 53566 405dc4 53567 405dc8 53566->53567 53568 402ed0 12 API calls 53567->53568 53569 405da4 PyErr_Occurred 53567->53569 53568->53567 53570 405dba free 53569->53570 53571 405dae PyErr_Print PyErr_Clear 53569->53571 53572 405d50 53570->53572 53571->53570 53573 401980 12 API calls 53572->53573 53574 405de0 53572->53574 53575 4019c0 35 API calls 53572->53575 53573->53572 53576 405d7d PyMarshal_ReadObjectFromString 53575->53576 53576->53567 53577 405d93 PyImport_ExecCodeModule 53576->53577 53577->53567 53577->53569 53578 401124 __wgetmainargs 53579 408668 53580 408670 memcmp 53579->53580 53581 4086b2 free 53580->53581 53583 4085d6 53580->53583 53583->53580 53583->53581 53584 40ef60 6 API calls 53583->53584 53585 40863f fread 53583->53585 53584->53583 53585->53581 53585->53583 53586 401b2c 53587 401b30 53586->53587 53588 4046b0 13 API calls 53587->53588 53589 401b43 53588->53589 53590 401b51 53589->53590 53591 4019d9 53589->53591 53593 402ed0 12 API calls 53590->53593 53592 40ef60 6 API calls 53591->53592 53594 4019fb 53592->53594 53611 401af0 53593->53611 53595 401b70 53594->53595 53596 401a07 malloc 53594->53596 53617 403030 14 API calls 53595->53617 53598 401a1e 53596->53598 53599 401b9f 53596->53599 53602 401b00 53598->53602 53603 401a2c 53598->53603 53618 403030 14 API calls 53599->53618 53600 401b8b 53604 401610 24 API calls 53602->53604 53608 401adc 53603->53608 53609 401a73 fread 53603->53609 53610 401a48 53603->53610 53606 401b14 53604->53606 53605 401ae2 fclose 53605->53611 53607 401ac8 free 53606->53607 53606->53608 53607->53608 53608->53605 53608->53611 53609->53610 53612 401aa5 53609->53612 53610->53603 53610->53609 53613 401b20 53610->53613 53616 403030 14 API calls 53612->53616 53613->53605 53615 401b2a 53613->53615 53615->53611 53616->53607 53617->53600 53618->53608 53619 4044f0 53620 4044fb 53619->53620 53621 408b00 12 API calls 53620->53621 53622 40451c _wstat 53621->53622 53623 40a4b1 53624 40a436 malloc 53623->53624 53626 40a45c 53624->53626 53627 4011b3 53628 4011b8 53627->53628 53629 4011c0 Sleep 53628->53629 53634 4011ea 53628->53634 53631 4011cc 53629->53631 53630 401406 _amsg_exit 53633 401420 _initterm 53630->53633 53630->53634 53631->53628 53640 4011da 53631->53640 53632 401478 _initterm 53635 40149b 53632->53635 53633->53634 53634->53630 53634->53632 53634->53633 53634->53640 53638 4014a3 exit 53635->53638 53637 401241 SetUnhandledExceptionFilter 53637->53640 53639 401267 __p__wcmdln 53639->53640 53640->53630 53640->53634 53640->53639 53641 4012eb malloc 53640->53641 53642 4012e6 53640->53642 53653 40db40 12 API calls 53640->53653 53641->53635 53644 401311 53641->53644 53642->53641 53643 401346 malloc memcpy 53643->53644 53645 40136f 53643->53645 53644->53643 53644->53644 53654 40d710 _onexit 53645->53654 53647 401388 53655 40d7a0 378 API calls 53647->53655 53649 4013af 53649->53638 53650 4013c2 53649->53650 53651 4013d0 53650->53651 53652 401462 _cexit 53650->53652 53653->53637 53654->53647 53655->53649 53656 4017f4 53663 4016b1 53656->53663 53657 401770 fwrite 53659 4018ca 53657->53659 53660 40179c ferror 53657->53660 53658 402ed0 12 API calls 53669 401826 53658->53669 53666 4017e9 53659->53666 53660->53659 53662 4017b0 53660->53662 53661 40187f memcpy 53661->53663 53662->53663 53663->53657 53663->53661 53663->53666 53667 4016d5 fread 53663->53667 53668 401858 53663->53668 53663->53669 53664 401832 free free 53665 401846 53664->53665 53666->53658 53666->53669 53667->53669 53670 401701 ferror 53667->53670 53669->53664 53670->53663 53670->53669 53671 4018b6 53672 401826 53671->53672 53673 401832 free free 53672->53673 53674 401846 53673->53674

                                                                                                                                                                                                                        Executed Functions

                                                                                                                                                                                                                        Function 0040117C Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 206sleepCOMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 230 40117c-40119a 231 4011a0-4011b1 230->231 232 401451-40145a GetStartupInfoW 230->232 233 4011cc-4011d8 231->233 234 401462-401477 _cexit 232->234 235 4011b8-4011ba 233->235 236 4011da-4011e4 233->236 239 4011c0-4011c9 Sleep 235->239 240 4013f3-401400 235->240 237 401406-40141a _amsg_exit 236->237 238 4011ea-4011f1 236->238 243 401420-401440 _initterm 237->243 244 40120f-401211 237->244 241 4011f7-401209 238->241 242 401478-401491 _initterm 238->242 239->233 240->237 240->238 241->243 241->244 249 40149b 242->249 245 401446-40144c 243->245 246 401217-40121e 243->246 244->245 244->246 245->246 247 401220-401239 246->247 248 40123c-40127c call 40db40 SetUnhandledExceptionFilter call 4173c0 call 40d970 __p__wcmdln 246->248 247->248 258 401292-401299 248->258 259 40127e 248->259 253 4014a3-4014af exit 249->253 260 401280-401283 258->260 261 40129b-4012a7 258->261 262 4012cd-4012d5 259->262 265 401285-401288 260->265 266 4012a9-4012b0 260->266 267 40128f 261->267 263 4012d7-4012e0 262->263 264 4012eb-40130b malloc 262->264 268 4012e6 263->268 269 4013ea 263->269 264->249 270 401311-40131d 264->270 265->266 271 40128a 265->271 272 4012b2 266->272 273 4012c8 266->273 267->258 268->264 269->240 274 401320-401326 270->274 271->267 275 4012b8-4012c6 272->275 273->262 276 4013e0-4013e5 274->276 277 40132c-401331 274->277 275->273 275->275 278 401346-40136d malloc memcpy 276->278 279 401338-401341 277->279 278->274 281 40136f-4013bc call 40d770 call 40d7a0 278->281 279->279 280 401343 279->280 280->278 281->253 286 4013c2-4013ca 281->286 286->234 287 4013d0-4013db 286->287
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled__p__wcmdlnmemcpy
                                                                                                                                                                                                                        • String ID: h2r
                                                                                                                                                                                                                        • API String ID: 1204267290-3942516715
                                                                                                                                                                                                                        • Opcode ID: eac8becde6c0dd191b15aea711b8aa84f0afa324810f6ed2f537ece7752c968d
                                                                                                                                                                                                                        • Instruction ID: 676354774380156a6d31bcdc11651c5caae96c91ab7a06ee3bbcf8190cbc5d75
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: eac8becde6c0dd191b15aea711b8aa84f0afa324810f6ed2f537ece7752c968d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BF81AF70A042018FDB24EFA4D98576A77F0FB44304F51453EDA85AB3B1D7789885CB8A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00403880 Relevance: 91.3, APIs: 39, Strings: 13, Instructions: 262COMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyImport_AddModule.PYTHON310 ref: 004038A1
                                                                                                                                                                                                                        • PyModule_GetDict.PYTHON310 ref: 004038B4
                                                                                                                                                                                                                        • PyUnicode_FromString.PYTHON310 ref: 0040395C
                                                                                                                                                                                                                        • PyObject_SetAttrString.PYTHON310 ref: 00403975
                                                                                                                                                                                                                        • Py_DecRef.PYTHON310 ref: 00403982
                                                                                                                                                                                                                        • PyMarshal_ReadObjectFromString.PYTHON310 ref: 00403992
                                                                                                                                                                                                                        • PyObject_SetAttrString.PYTHON310 ref: 004039AF
                                                                                                                                                                                                                        • PyEval_EvalCode.PYTHON310 ref: 004039C8
                                                                                                                                                                                                                        • free.MSVCRT ref: 004039D5
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: String$AttrFromObject_$CodeDictEvalEval_Import_Marshal_ModuleModule_ObjectReadUnicode_free
                                                                                                                                                                                                                        • String ID: %s%c%s.py$Absolute path to script exceeds PATH_MAX$Could not get __main__ module's dict.$Could not get __main__ module.$Failed to unmarshal code object for %s$Traceback is disabled via bootloader option.$\$__file__$__main__$_pyi_main_co$format_exception$pyi-disable-windowed-traceback$traceback
                                                                                                                                                                                                                        • API String ID: 1659846952-4198433784
                                                                                                                                                                                                                        • Opcode ID: 15c4208f2d8e130932219e82c4b0b5fb2b9fa64d0c384d1944226fe3b7cf001d
                                                                                                                                                                                                                        • Instruction ID: 6540644356b1fe9e7dd3889ac2da6173512776e99aae4954ed64b62622b12aad
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 15c4208f2d8e130932219e82c4b0b5fb2b9fa64d0c384d1944226fe3b7cf001d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 35B1C4B4608701DFC710AF29D58815ABBE4BF88355F41892EE9D9D3390DBB8C981CF5A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00401610 Relevance: 28.2, APIs: 9, Strings: 7, Instructions: 186fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 49 401610-40166c call 40a4f0 52 401672-401682 malloc 49->52 53 4018d4-4018f4 call 402ed0 49->53 54 401688-40169e malloc 52->54 55 401919-401938 call 403030 52->55 63 401846-401852 53->63 58 4016a4-4016ad 54->58 59 4018f9-401914 call 403030 54->59 62 4016b1-4016cf 58->62 68 401826-401841 call 40c7c0 free * 2 59->68 65 4016d5-4016fb fread 62->65 66 401858-401868 62->66 69 4018c0-4018c5 65->69 70 401701-40170f ferror 65->70 68->63 69->68 70->69 72 401715-40171d 70->72 73 401721-40174a call 40a5c0 72->73 77 401750-401753 73->77 78 4017f8-4017fb 73->78 79 401806-401821 call 402ed0 77->79 80 401759-40176a 77->80 78->80 81 401801 78->81 79->68 83 401870-401879 80->83 84 401770-401796 fwrite 80->84 81->79 87 4017b4-4017b6 83->87 88 40187f-4018b1 memcpy 83->88 85 4018ca-4018cf 84->85 86 40179c-4017aa ferror 84->86 85->79 86->85 89 4017b0 86->89 87->73 90 4017bc-4017dd 87->90 88->87 89->87 90->68 91 4017df-4017e3 90->91 91->62 92 4017e9-4017f0 91->92 92->68 93 4017f2 92->93 93->79
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • 1.2.13, xrefs: 00401628
                                                                                                                                                                                                                        • Failed to extract %s: decompression resulted in return code %d!, xrefs: 00401813
                                                                                                                                                                                                                        • Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 004018E1
                                                                                                                                                                                                                        • Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 004018FC
                                                                                                                                                                                                                        • Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 0040191D
                                                                                                                                                                                                                        • malloc, xrefs: 00401908, 00401925
                                                                                                                                                                                                                        • 8, xrefs: 00401620
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ferrorfreemalloc$freadfwritememcpy
                                                                                                                                                                                                                        • String ID: 1.2.13$8$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                                                        • API String ID: 3882407908-2046485118
                                                                                                                                                                                                                        • Opcode ID: d25199e72a9c78f064208eb155d88d6c3da84988dbe3a474574327916eacab17
                                                                                                                                                                                                                        • Instruction ID: 36ffe3033784580453c6a567143783feaca3ec72a60cee7d1f4dfc22211088d5
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d25199e72a9c78f064208eb155d88d6c3da84988dbe3a474574327916eacab17
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F481D3B56093019FD750EF29C08461BBBE1BF88358F508A2EF4D8973A1E778D985CB46
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00401E60 Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 165COMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 94 401e60-401e6f 95 402020-402039 call 4046b0 94->95 96 401e75-401eb0 call 408550 94->96 95->96 102 40203f-402044 95->102 101 401eb6-401ece call 40ef60 96->101 96->102 106 401ed4-401ef7 fread 101->106 107 40208f-4020a3 call 403030 101->107 104 402014-40201d 102->104 109 402061-40207a call 403030 106->109 110 401efd-401f67 call 40ef60 malloc 106->110 107->102 109->104 116 4020a5-4020bc call 403030 110->116 117 401f6d-401f89 fread 110->117 116->104 118 402046-40205f call 403030 117->118 119 401f8f-401fa6 ferror 117->119 118->104 122 40207c-40208d call 402ed0 119->122 123 401fac-401fb2 119->123 122->104 126 401fb8-401fba 123->126 128 402000-402004 126->128 129 401fbc-401fdf 126->129 128->104 132 402006-40200e fclose 128->132 129->126 131 401fe1-401ff4 call 402ed0 129->131 131->129 135 401ff6-401ffd 131->135 132->104 135->128
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 00408550: malloc.MSVCRT ref: 00408562
                                                                                                                                                                                                                          • Part of subcall function 00408550: fread.MSVCRT ref: 00408656
                                                                                                                                                                                                                          • Part of subcall function 00408550: free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401EAA), ref: 004086BF
                                                                                                                                                                                                                        • fread.MSVCRT ref: 00401EF0
                                                                                                                                                                                                                        • malloc.MSVCRT ref: 00401F5D
                                                                                                                                                                                                                        • fread.MSVCRT ref: 00401F82
                                                                                                                                                                                                                        • ferror.MSVCRT ref: 00401F9D
                                                                                                                                                                                                                        • fclose.MSVCRT ref: 00402009
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: fread$malloc$fcloseferrorfree
                                                                                                                                                                                                                        • String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$X$fread$fseek$malloc
                                                                                                                                                                                                                        • API String ID: 938791849-202209224
                                                                                                                                                                                                                        • Opcode ID: 184307eea2abe11cbc5b19158909a6000e688a56696f3d40b4622786db81104a
                                                                                                                                                                                                                        • Instruction ID: 48232b83441798ba76066763261cf49e77d2abc7de2ba2fc6216de52d01d1662
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 184307eea2abe11cbc5b19158909a6000e688a56696f3d40b4622786db81104a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 40616EB0905301CFCB04DF25C58865ABBE1BF88314F15C96EE9989B3D6D778D884CB9A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040E900 Relevance: 27.3, APIs: 18, Instructions: 269COMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 136 40e900-40e921 setlocale 137 40e923-40e92b _strdup 136->137 138 40e92d-40e946 setlocale 136->138 137->138 139 40e950-40e9b1 wcstombs realloc wcstombs setlocale free 138->139 140 40e948-40e94e 138->140 141 40e9b7-40e9c0 139->141 140->139 142 40e9c8-40ea1f mbstowcs call 40e630 mbstowcs 140->142 145 40ea60-40ea64 142->145 146 40ea21-40ea32 142->146 149 40ea67-40ea6c 145->149 147 40ec40-40ec44 146->147 148 40ea38-40ea3c 146->148 147->149 150 40ec4a-40ec4f 147->150 148->147 151 40ea42-40ea46 148->151 152 40ea80-40ea89 149->152 153 40ea6e-40ea71 149->153 150->149 154 40ec55-40ec70 setlocale free 150->154 151->149 155 40ea48-40ea56 151->155 156 40eaa4-40eaa8 152->156 153->139 157 40eb66-40eb69 154->157 155->149 158 40ea90-40ea96 156->158 159 40eaaa-40eab1 156->159 157->141 162 40ea98-40eaa2 158->162 163 40eabb-40eac2 158->163 160 40eab3-40eab7 159->160 161 40eac4-40eac8 159->161 164 40eab8 160->164 161->164 165 40eaca-40eacf 161->165 162->156 166 40ead8-40eadb 162->166 163->161 163->164 164->163 165->166 167 40ead1-40ead3 165->167 168 40eb70-40eb78 166->168 169 40eae1-40eae9 166->169 167->162 172 40eccb 168->172 173 40eb7e-40eb85 168->173 170 40eaeb-40eaef 169->170 171 40eafc-40eb49 wcstombs realloc wcstombs 169->171 170->171 174 40eaf1-40eaf9 170->174 175 40eb4e-40eb61 setlocale free 171->175 176 40ecd1-40ecd9 172->176 177 40eb8d-40eb9c 172->177 173->168 178 40eb87-40eb8b 173->178 174->171 175->157 181 40ece5-40eced 176->181 182 40ecdb-40ecdf 176->182 179 40ebb0-40ebbb 177->179 180 40eb9e-40eba2 177->180 178->168 178->177 179->179 186 40ebbd-40ebc1 179->186 184 40ec75-40ec79 180->184 185 40eba8-40ebaf 180->185 181->177 183 40ecf3-40ecfb 181->183 182->177 182->181 183->177 187 40ed01-40ed08 183->187 189 40ebd0 184->189 190 40ec7f-40ec82 184->190 185->179 186->179 188 40ebc3-40ebca 186->188 187->177 188->184 188->189 191 40ebd2-40ebd5 189->191 190->191 192 40ec9b-40ecbc wcstombs 191->192 193 40ebdb-40ebe0 191->193 192->175 195 40ecc2-40ecc6 192->195 194 40ec06-40ec11 193->194 196 40ec13 194->196 197 40ebe8-40ebf3 194->197 195->175 200 40ec16-40ec1a 196->200 198 40ec90-40ec92 197->198 199 40ebf9-40ebfb 197->199 198->200 201 40ebfd-40ec00 199->201 202 40ec28-40ec33 200->202 203 40ec1c-40ec22 200->203 201->194 206 40ec98 201->206 202->202 205 40ec35-40ec39 202->205 203->201 204 40ec24 203->204 204->202 205->202 207 40ec3b 205->207 206->192 207->201
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: setlocale$wcstombs$_strdupfreerealloc
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2293806352-0
                                                                                                                                                                                                                        • Opcode ID: 24aa9c2407c2a4c3f4ed46904f0d809acaa0fb0afecc03c31603bba52fa15124
                                                                                                                                                                                                                        • Instruction ID: 614429c9ea5f0c0fbdd7ec2be82af17343d93239b7468d5b99009060838935dd
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 24aa9c2407c2a4c3f4ed46904f0d809acaa0fb0afecc03c31603bba52fa15124
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 48A161709042158ADB24AF66C0452BBF7F1FF44344F45883FE489A7391E33D9892DB8A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00405CF0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 72stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 208 405cf0-405d28 strlen PyUnicode_Decode 209 405dea-405dfb call 402ed0 208->209 210 405d2e-405d45 PySys_SetObject 208->210 219 405de2-405de9 209->219 212 405d63-405d6c 210->212 213 405d47 210->213 215 405d50-405d61 call 401980 212->215 216 405d6e-405d91 call 4019c0 PyMarshal_ReadObjectFromString 212->216 217 405de0 213->217 215->212 215->217 223 405d93-405da2 PyImport_ExecCodeModule 216->223 224 405dc8-405dd8 call 402ed0 216->224 217->219 223->224 225 405da4-405dac PyErr_Occurred 223->225 224->225 227 405dba-405dc2 free 225->227 228 405dae-405db4 PyErr_Print PyErr_Clear 225->228 227->215 228->227
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Err_$Object$ClearCodeDecodeExecFromImport_Marshal_ModuleOccurredPrintReadStringSys_Unicode_freestrlen
                                                                                                                                                                                                                        • String ID: Failed to get _MEIPASS as PyObject.$Module object for %s is NULL!$_MEIPASS$strict$utf-8
                                                                                                                                                                                                                        • API String ID: 1645963791-985300917
                                                                                                                                                                                                                        • Opcode ID: 6a5a0fc19d408c57ccd74b2a843a6cf11713645823d17a702bec6b19c546019a
                                                                                                                                                                                                                        • Instruction ID: b798077ea826a97b31ed519bc33854408a60d385b89e575b30205180b7c9f22a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6a5a0fc19d408c57ccd74b2a843a6cf11713645823d17a702bec6b19c546019a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 692117B0219B009BC7207F25D98856BBBE4FE80750F45892FE4C997291D7789482DF6B
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004019C0 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 141COMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 288 4019c0-4019d3 289 401b30-401b4b call 4046b0 288->289 290 4019d9-401a01 call 40ef60 288->290 289->290 297 401b51-401b68 call 402ed0 289->297 295 401b70-401b9e call 403030 290->295 296 401a07-401a18 malloc 290->296 299 401a1e-401a26 296->299 300 401b9f-401bc2 call 403030 296->300 307 401af0-401afb 297->307 305 401b00-401b16 call 401610 299->305 306 401a2c-401a32 299->306 311 401adc-401ae0 300->311 315 401ac8-401ad4 free 305->315 316 401b18-401b1c 305->316 310 401a38-401a40 306->310 306->311 314 401a58-401a6a 310->314 311->307 312 401ae2-401aea fclose 311->312 312->307 317 401a73-401aa3 fread 314->317 318 401a6c-401a71 314->318 315->311 316->312 319 401b1e 316->319 320 401aa5-401ac3 call 403030 317->320 321 401a48-401a52 317->321 318->317 319->307 320->315 321->314 322 401b20-401b28 321->322 322->312 324 401b2a 322->324 324->307
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • malloc.MSVCRT ref: 00401A0D
                                                                                                                                                                                                                        • fread.MSVCRT ref: 00401A94
                                                                                                                                                                                                                        • free.MSVCRT(?,?,?,?,0040638C,?,?,?,?,?,?,?,?,00000000,?,004040A4), ref: 00401ACF
                                                                                                                                                                                                                        • fclose.MSVCRT ref: 00401AE5
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to extract %s: failed to seek to the entry's data!, xrefs: 00401B73
                                                                                                                                                                                                                        • fread, xrefs: 00401AB5
                                                                                                                                                                                                                        • fseek, xrefs: 00401B7F
                                                                                                                                                                                                                        • Failed to extract %s: failed to open archive file!, xrefs: 00401B55
                                                                                                                                                                                                                        • malloc, xrefs: 00401BB2
                                                                                                                                                                                                                        • Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00401BA7
                                                                                                                                                                                                                        • Failed to extract %s: failed to read data chunk!, xrefs: 00401AAD
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: fclosefreadfreemalloc
                                                                                                                                                                                                                        • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                        • API String ID: 3295367466-3659356012
                                                                                                                                                                                                                        • Opcode ID: 8884fdb84953ef4ecbf5526515473dd84cde1690139ba998021ef6e9a9ea1245
                                                                                                                                                                                                                        • Instruction ID: c4bf1cbcbd5ed2c421977dfe96b942ab9f05e938e4513c73373e5f6d25da3068
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8884fdb84953ef4ecbf5526515473dd84cde1690139ba998021ef6e9a9ea1245
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A25103B16093019FD700EF2AD49461BBBE4AF85744F05882EF988DB351E779D885CF8A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004038E1 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 59COMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyUnicode_FromString.PYTHON310 ref: 0040395C
                                                                                                                                                                                                                        • PyObject_SetAttrString.PYTHON310 ref: 00403975
                                                                                                                                                                                                                        • Py_DecRef.PYTHON310 ref: 00403982
                                                                                                                                                                                                                        • PyMarshal_ReadObjectFromString.PYTHON310 ref: 00403992
                                                                                                                                                                                                                        • PyObject_SetAttrString.PYTHON310 ref: 004039AF
                                                                                                                                                                                                                        • PyEval_EvalCode.PYTHON310 ref: 004039C8
                                                                                                                                                                                                                        • free.MSVCRT ref: 004039D5
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: String$AttrFromObject_$CodeEvalEval_Marshal_ObjectReadUnicode_free
                                                                                                                                                                                                                        • String ID: %s%c%s.py$\$__file__$_pyi_main_co
                                                                                                                                                                                                                        • API String ID: 3638413197-1862493962
                                                                                                                                                                                                                        • Opcode ID: 46cf789b736286b4a61b83edaca85d21ba6631443c1c9059bb822cdedcba4429
                                                                                                                                                                                                                        • Instruction ID: c970f6cc1162f0d106d27565064d24bae80cc5d647643b18d1f9b1af61abd66d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 46cf789b736286b4a61b83edaca85d21ba6631443c1c9059bb822cdedcba4429
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 58219BB4909701EFC710AF24C18865ABFE4BF88745F41892EE8C993350E7B8D985DF4A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00405DC4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39COMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 363 405dc4 364 405dc8-405dd8 call 402ed0 363->364 367 405da4-405dac PyErr_Occurred 364->367 368 405dba-405dc2 free 367->368 369 405dae-405db4 PyErr_Print PyErr_Clear 367->369 370 405d50-405d61 call 401980 368->370 369->368 373 405de0-405de9 370->373 374 405d63-405d6c 370->374 374->370 375 405d6e-405d91 call 4019c0 PyMarshal_ReadObjectFromString 374->375 375->364 379 405d93-405da2 PyImport_ExecCodeModule 375->379 379->364 379->367
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Module object for %s is NULL!, xrefs: 00405DCC
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Err_$ClearCodeExecFromImport_Marshal_ModuleObjectOccurredPrintReadStringfree
                                                                                                                                                                                                                        • String ID: Module object for %s is NULL!
                                                                                                                                                                                                                        • API String ID: 2954924069-1939177074
                                                                                                                                                                                                                        • Opcode ID: 7f3ff4246443669002559e413b6afe45e893b7647b27d817c239185db9502501
                                                                                                                                                                                                                        • Instruction ID: 5b8f683c50dc34ce5f11ffbd1f02edeffe67dd040c89a12bc9db49ded73bce97
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7f3ff4246443669002559e413b6afe45e893b7647b27d817c239185db9502501
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3A01D3B0609B00DBC7206F25D54926BBBE1EE44740F45882FE489D6291DB788882DF5A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040EF90 Relevance: 9.1, APIs: 6, Instructions: 54COMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 380 40ef90-40efaa 381 40efd8-40efea fgetpos 380->381 382 40efac-40efaf 380->382 385 40f03c-40f041 381->385 386 40efec-40eff4 381->386 383 40f000-40f028 fflush _fileno _filelengthi64 382->383 384 40efb1-40efb3 382->384 389 40efc1-40efc8 fsetpos 383->389 387 40efb5-40efbd 384->387 388 40f02a-40f03a _errno 384->388 390 40efcd-40efd4 385->390 386->383 386->389 387->389 388->390 389->390
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: _errno_filelengthi64_filenofflushfgetposfsetpos
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 4183758535-0
                                                                                                                                                                                                                        • Opcode ID: 0e874d7c1527097df73717f8d8dd802be641f195fc25bc8155d28149c3b9a275
                                                                                                                                                                                                                        • Instruction ID: 4b13233adec89eef7c79cf0ca00fcee1fa5ec0274880c3d786e8fbaf61c832b7
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0e874d7c1527097df73717f8d8dd802be641f195fc25bc8155d28149c3b9a275
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7A113DB15087059BC310AF2A958105FBBE4EF91354F120D3FF89493292E239D999CB96
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00405D4C Relevance: 9.0, APIs: 6, Instructions: 35COMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 391 405d4c 392 405d50-405d61 call 401980 391->392 395 405de0-405de9 392->395 396 405d63-405d6c 392->396 396->392 397 405d6e-405d91 call 4019c0 PyMarshal_ReadObjectFromString 396->397 401 405d93-405da2 PyImport_ExecCodeModule 397->401 402 405dc8-405dd8 call 402ed0 397->402 401->402 403 405da4-405dac PyErr_Occurred 401->403 402->403 405 405dba-405dc2 free 403->405 406 405dae-405db4 PyErr_Print PyErr_Clear 403->406 405->392 406->405
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Err_$ClearCodeExecFromImport_Marshal_ModuleObjectOccurredPrintReadStringfree
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2954924069-0
                                                                                                                                                                                                                        • Opcode ID: adc5dfaa51ca1f11fe256012238351c5b7b9446f2bef57875ae31e97d593283a
                                                                                                                                                                                                                        • Instruction ID: cbea3933326be5ba74a4cecacd0323492524317ff469b2c4e41e1fb4f155b449
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: adc5dfaa51ca1f11fe256012238351c5b7b9446f2bef57875ae31e97d593283a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E901D6B0605B01DFC7206F25994822BBBE1EE44740B45883FE999D7291DB78C842DF5A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00408550 Relevance: 6.1, APIs: 4, Instructions: 119COMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 408 408550-40856b malloc 409 408571-40858f call 40ef60 408->409 410 4086b8-4086ba 408->410 409->410 414 408595-4085b8 call 40f050 409->414 412 4086bc-4086cf free 410->412 414->410 417 4085be-4085d2 414->417 418 4085d6-4085ec 417->418 419 4085fe-40861d 418->419 420 4085ee-4085f6 418->420 421 4086b2-4086b4 419->421 422 408623-40863d call 40ef60 419->422 420->419 421->410 422->421 425 40863f-40865d fread 422->425 425->421 426 40865f-408666 425->426 427 408690-408692 426->427 428 408670-40868c memcmp 427->428 429 408694-4086ac 427->429 430 4086d0-4086e6 428->430 431 40868e 428->431 429->418 429->421 430->412 431->427
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: freadfreemalloc
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2848089211-0
                                                                                                                                                                                                                        • Opcode ID: 1a9925d51e5002b52557f3f82c440e3fe1630ff818de9e7bab4658c492a1da82
                                                                                                                                                                                                                        • Instruction ID: cab96f3465d474487508a1ec879676b61213e1df38a8e45f68965f676f42926a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1a9925d51e5002b52557f3f82c440e3fe1630ff818de9e7bab4658c492a1da82
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 78413B716083118BC710DF29C58060FFBE1AFC8354F168E2EF9D897391EA79D8498B86
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040EFF6 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 432 40eff6-40effd 433 40f000-40f028 fsetpos fflush _fileno _filelengthi64 432->433 435 40efcd-40efd4 433->435
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: _filelengthi64_filenofflushfsetpos
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1406207278-0
                                                                                                                                                                                                                        • Opcode ID: 1ed6eb79ae09dcc32bdfa7ab410ec694ef2291df6c0a71ee54ab17ab7ac6ca82
                                                                                                                                                                                                                        • Instruction ID: 1330b5d8d42a305a2191b976321c9ddfa34460ad39984d8d2968ac2a071300d9
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1ed6eb79ae09dcc32bdfa7ab410ec694ef2291df6c0a71ee54ab17ab7ac6ca82
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5BE0EDB2908B158BC700BF66A88119DFBE0FF80358F134C2FE4D953212E638A5D58B86
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00401124 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 15COMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 436 401124-40116d __wgetmainargs
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: __wgetmainargs
                                                                                                                                                                                                                        • String ID: B$h2r
                                                                                                                                                                                                                        • API String ID: 1709950718-1302400621
                                                                                                                                                                                                                        • Opcode ID: 41afb40690170ecdc9a50beea52290fec0f59d8749ba09f0fc9408188c674ce4
                                                                                                                                                                                                                        • Instruction ID: 27c32f95ce735926b30c16c90320b224d17bcd53438576fbaefc61be872f07d1
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 41afb40690170ecdc9a50beea52290fec0f59d8749ba09f0fc9408188c674ce4
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 81E092B1A04711EFC714DF25E645246BBE0BB48308F81D91EE69897210D3B9A549DF8A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004017F4 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 26fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 437 4017f4 438 4017f8-4017fb 437->438 439 401801 438->439 440 401759-40176a 438->440 443 401806-401821 call 402ed0 439->443 441 401870-401879 440->441 442 401770-401796 fwrite 440->442 447 4017b4-4017b6 441->447 448 40187f-4018b1 memcpy 441->448 445 4018ca-4018cf 442->445 446 40179c-4017aa ferror 442->446 449 401826-401841 call 40c7c0 free * 2 443->449 445->443 446->445 450 4017b0 446->450 451 401721-40174a call 40a5c0 447->451 452 4017bc-4017dd 447->452 448->447 461 401846-401852 449->461 450->447 451->438 460 401750-401753 451->460 452->449 455 4017df-4017e3 452->455 458 4016b1-4016cf 455->458 459 4017e9-4017f0 455->459 463 4016d5-4016fb fread 458->463 464 401858-401868 458->464 459->449 462 4017f2 459->462 460->440 460->443 462->443 465 4018c0-4018c5 463->465 466 401701-40170f ferror 463->466 465->449 466->465 467 401715-40171d 466->467 467->451
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to extract %s: decompression resulted in return code %d!, xrefs: 00401813
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: free$ferrorfwrite
                                                                                                                                                                                                                        • String ID: Failed to extract %s: decompression resulted in return code %d!
                                                                                                                                                                                                                        • API String ID: 2451956730-2259475180
                                                                                                                                                                                                                        • Opcode ID: 830b903f36b84025c492a9392f2ebfc8541cf9aaa14fb670190ebe148b401e78
                                                                                                                                                                                                                        • Instruction ID: 3822a968a1abd095370c554b2ca83eb16347efd21d9f73064333f8d65a1dff39
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 830b903f36b84025c492a9392f2ebfc8541cf9aaa14fb670190ebe148b401e78
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5AF01CB56097008BC710BF29E48105EBBE1FF81324F528A2EF5E897381D739D8818B86
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004044F0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                                                                                                                                                                                                        • _wstat.MSVCRT ref: 00404527
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ByteCharMultiWide_wstat
                                                                                                                                                                                                                        • String ID: vW@
                                                                                                                                                                                                                        • API String ID: 35547977-739985395
                                                                                                                                                                                                                        • Opcode ID: f68f487c7fc98f073bf5515ade25dc7e50f262739ba4e39397ed4c0b26112309
                                                                                                                                                                                                                        • Instruction ID: a5fa3471d1d6b00994ce1f6807dd4af604ac1712bdf86b7583ceec80064c9dbb
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f68f487c7fc98f073bf5515ade25dc7e50f262739ba4e39397ed4c0b26112309
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 79E0E5B08093009BC700EF7AC58925ABBE4BB88384F808C2DB488C3291E7398548CB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040A3F0 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 62COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: malloc
                                                                                                                                                                                                                        • String ID: 8
                                                                                                                                                                                                                        • API String ID: 2803490479-4194326291
                                                                                                                                                                                                                        • Opcode ID: 88865b5b26300d2bd4c71fb6e3d37b9dfb2c71bd695db075464367e8e3ddd3a1
                                                                                                                                                                                                                        • Instruction ID: 3d9a3cba30c8a6cce76611aecb6f7ccedd9577938697bd5609853f48fc3db6fb
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 88865b5b26300d2bd4c71fb6e3d37b9dfb2c71bd695db075464367e8e3ddd3a1
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 542159B45083018FDB10DF29C5886267BE0AF48314F51866EA8499B3C5E3B8CC65CF47
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00408100 Relevance: 3.0, APIs: 2, Instructions: 22libraryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                                                                                                                                                                                                        • LoadLibraryExW.KERNEL32 ref: 00408136
                                                                                                                                                                                                                        • free.MSVCRT(?,?,?,?,?,00000000), ref: 00408144
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ByteCharLibraryLoadMultiWidefree
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3231889924-0
                                                                                                                                                                                                                        • Opcode ID: 5d8565fb56928c0b2a339ae78370c30edaeabbfce472f749a9e73ddc86dce43c
                                                                                                                                                                                                                        • Instruction ID: 9c98291bb8aeede50614ca81ae0f1542a833f490e58002a57af99077e474df99
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5d8565fb56928c0b2a339ae78370c30edaeabbfce472f749a9e73ddc86dce43c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 72E0E5F19093009BDB00BF78E58934BBEE0AB44344F02892DE4C88B341E67988448B82
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004018B6 Relevance: 2.5, APIs: 2, Instructions: 19COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: free
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1294909896-0
                                                                                                                                                                                                                        • Opcode ID: ef69f32362a42e0ce2ffe8284a07d848220a277b661e213d5c3d7f37b51e11aa
                                                                                                                                                                                                                        • Instruction ID: 37d18b623566974bb2935c6215979c875cfe96a297bc96d00919041d074b5ac9
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ef69f32362a42e0ce2ffe8284a07d848220a277b661e213d5c3d7f37b51e11aa
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 80E0E6B6604715CBCB107F65F48119DF7E0FF41328F124A3FE9E493291D639A5454B86
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004046B0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                                                                                                                                                                                                        • _wfopen.MSVCRT ref: 00404703
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ByteCharMultiWide_wfopen
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 372205238-0
                                                                                                                                                                                                                        • Opcode ID: 13c07e3d3bc0b19f75017dbdb54b07b75c5c7dcab1f4d19b5ddeb740e7124e77
                                                                                                                                                                                                                        • Instruction ID: 3468f0b4211825adde8639be08c033172f5b0e4316271c3a96c81e3ef559f4c6
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 13c07e3d3bc0b19f75017dbdb54b07b75c5c7dcab1f4d19b5ddeb740e7124e77
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2FF0F2B04193009FC314FF28D58868EBBE8FF88348F018C2EF5C897252D6789549CB92
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040A4B1 Relevance: 1.3, APIs: 1, Instructions: 37COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: malloc
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2803490479-0
                                                                                                                                                                                                                        • Opcode ID: e2173ce04817a78d231aa9074b1aa79180b14f8ea2ab174e27efc7c36e8625ac
                                                                                                                                                                                                                        • Instruction ID: 34294cd6affbb3e785c4932bfc48d0f633533baf833ca0b38d678e79e0ec05fd
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e2173ce04817a78d231aa9074b1aa79180b14f8ea2ab174e27efc7c36e8625ac
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 87011EB45053018FDB54DF19C184356BBE0FF88304F55896EE8889B385D3B8C855CF46
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Non-executed Functions

                                                                                                                                                                                                                        Function 004011B3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 119sleepCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: malloc$ExceptionFilterSleepUnhandled__p__wcmdln_amsg_exit_inittermmemcpy
                                                                                                                                                                                                                        • String ID: h2r
                                                                                                                                                                                                                        • API String ID: 527270645-3942516715
                                                                                                                                                                                                                        • Opcode ID: 0fc769238dbcbaccc1defde77868a2231646de065e682eb93854c2df569345b0
                                                                                                                                                                                                                        • Instruction ID: 9529fa1fa00849a3a4482e99920bc3e8817caf8231a65d9ae2bb721758bc0f10
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0fc769238dbcbaccc1defde77868a2231646de065e682eb93854c2df569345b0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 45414DB4A043018FDB20EFA9D98475AB7F0FB44344F51453EE985A73B0DBB89845CB89
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00401170 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135sleepCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled__p__wcmdlnmemcpy
                                                                                                                                                                                                                        • String ID: h2r
                                                                                                                                                                                                                        • API String ID: 1204267290-3942516715
                                                                                                                                                                                                                        • Opcode ID: b6dbdc372fc45292959b8ad62cb9b1d82b3ea37c5ee8f48f33ec792cbd8abaac
                                                                                                                                                                                                                        • Instruction ID: 683df0bb935b0ba919073670d03ce8182cb7faa8ee4b460d1895c998537b4a50
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b6dbdc372fc45292959b8ad62cb9b1d82b3ea37c5ee8f48f33ec792cbd8abaac
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0C5180B0A043019FDB20DFA8D984B5AB7F0FB44344F11453EE945AB3B1D7789845CB89
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00406D50 Relevance: 164.9, APIs: 31, Strings: 63, Instructions: 385libraryloaderCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AddressProc
                                                                                                                                                                                                                        • String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                                                        • API String ID: 190572456-2208601799
                                                                                                                                                                                                                        • Opcode ID: 48fc8fb41c16fe699d029926af7cab486289aba105d4ff2453387a530e0e4b39
                                                                                                                                                                                                                        • Instruction ID: b9744897239d32f33dc6bfef900ed9271cf1591fb07702e628d33a7ecb5ec9b2
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 48fc8fb41c16fe699d029926af7cab486289aba105d4ff2453387a530e0e4b39
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C3F108B090A701CBC7106F759A4506EBAF0AE41758F40CA3FB4A49B2C1DB7C9499DB9F
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004025E0 Relevance: 47.5, APIs: 20, Strings: 7, Instructions: 234windowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: MessageSend$Create$Window$BaseClientDialogFontIconIndirectInfoLoadMetricParametersRectSystemUnits
                                                                                                                                                                                                                        • String ID: $0$BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
                                                                                                                                                                                                                        • API String ID: 3223904152-2569830377
                                                                                                                                                                                                                        • Opcode ID: 7943c390b9244dced28919df85ac531d04cee13212c8fd2bffe6eea2c2ad8852
                                                                                                                                                                                                                        • Instruction ID: 2067da98e2504e100063f8f35cc28d01e2b4b69eff652bc710e7bd6244d7957c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7943c390b9244dced28919df85ac531d04cee13212c8fd2bffe6eea2c2ad8852
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B7C183B4909301DFE700EF68C19835ABFE0FB88354F10896EE8988B355D7B99548CF96
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00405A60 Relevance: 47.4, APIs: 10, Strings: 17, Instructions: 132COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 00407650: GetEnvironmentVariableW.KERNEL32(00000000,00403DEA), ref: 0040768F
                                                                                                                                                                                                                        • Py_SetProgramName.PYTHON310 ref: 00405AEC
                                                                                                                                                                                                                        • Py_SetPythonHome.PYTHON310 ref: 00405B19
                                                                                                                                                                                                                        • Py_GetPath.PYTHON310 ref: 00405BA6
                                                                                                                                                                                                                        • Py_SetPath.PYTHON310 ref: 00405BB3
                                                                                                                                                                                                                        • Py_Initialize.PYTHON310 ref: 00405BC0
                                                                                                                                                                                                                        • PySys_SetPath.PYTHON310 ref: 00405BCD
                                                                                                                                                                                                                        • PySys_SetArgvEx.PYTHON310 ref: 00405C0A
                                                                                                                                                                                                                        • free.MSVCRT ref: 00405C26
                                                                                                                                                                                                                        • free.MSVCRT ref: 00405C34
                                                                                                                                                                                                                        • PyErr_Occurred.PYTHON310 ref: 00405C39
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Path$Sys_free$ArgvEnvironmentErr_HomeInitializeNameOccurredProgramPythonVariable
                                                                                                                                                                                                                        • String ID: 0$ 0$%s%c%s%c%s%c%s%c%s$;$;$Error detected starting Python VM.$Failed to convert argv to wchar_t$Failed to convert progname to wchar_t$Failed to convert pyhome to wchar_t$Failed to convert pypath to wchar_t$Invalid value for PYTHONUTF8=%s; disabling utf-8 mode!$PYTHONUTF8$\$\$base_library.zip$lib-dynload$sys.path (based on %s) exceeds buffer[%d] space
                                                                                                                                                                                                                        • API String ID: 3602564992-4092346810
                                                                                                                                                                                                                        • Opcode ID: d52d000c1473065b0899b1ed74f52dc053d7693a20c2f5cf1e11e3dc0598f350
                                                                                                                                                                                                                        • Instruction ID: 22c84da25320057bd24c90e3ec615a054902b22b929e7a825a46e5f77c0d8298
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d52d000c1473065b0899b1ed74f52dc053d7693a20c2f5cf1e11e3dc0598f350
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B5513BB0609B009BE310AF65D54826BBBE0EF44354F458A2FE9D5A72D1C7BC8485CF9B
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05006780 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 199COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyObject_GetIter.PYTHON3(?), ref: 05006790
                                                                                                                                                                                                                        • PyErr_Clear.PYTHON3 ref: 050067A1
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(00000000), ref: 050067C0
                                                                                                                                                                                                                        • PyType_GetFlags.PYTHON3(?), ref: 050067CC
                                                                                                                                                                                                                        • ?sharedNull@QArrayData@@SAPAU1@XZ.QT5CORE(00000004), ref: 050067FD
                                                                                                                                                                                                                        • PyErr_Clear.PYTHON3 ref: 0500680B
                                                                                                                                                                                                                        • PyIter_Next.PYTHON3(00000000), ref: 05006812
                                                                                                                                                                                                                        • PyErr_Clear.PYTHON3 ref: 05006821
                                                                                                                                                                                                                        • PyFloat_AsDouble.PYTHON3(00000000), ref: 05006828
                                                                                                                                                                                                                        • PyErr_Occurred.PYTHON3 ref: 05006835
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(00000000,?), ref: 05006860
                                                                                                                                                                                                                        • PyErr_Clear.PYTHON3 ref: 0500686D
                                                                                                                                                                                                                        • PyIter_Next.PYTHON3(00000000), ref: 05006874
                                                                                                                                                                                                                        • PyErr_Occurred.PYTHON3(?), ref: 05006883
                                                                                                                                                                                                                        • ?deallocate@QArrayData@@SAXPAU1@II@Z.QT5CORE(00000000,00000008,00000008), ref: 050068B2
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(00000000), ref: 050068D7
                                                                                                                                                                                                                        • PyErr_Format.PYTHON3(6CFC9584,index %zd has type '%s' but 'int' is expected,?,00000000), ref: 05006914
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(00000000), ref: 05006934
                                                                                                                                                                                                                        • ?deallocate@QArrayData@@SAXPAU1@II@Z.QT5CORE(00000000,00000008,00000008), ref: 05006962
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(00000000), ref: 0500698F
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(00000000), ref: 050069A7
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • index %zd has type '%s' but 'int' is expected, xrefs: 0500690D
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Err_$Dealloc$Clear$ArrayData@@$?deallocate@Iter_NextOccurred$?sharedDoubleFlagsFloat_FormatIterNull@Object_Type_
                                                                                                                                                                                                                        • String ID: index %zd has type '%s' but 'int' is expected
                                                                                                                                                                                                                        • API String ID: 2357885391-1902674334
                                                                                                                                                                                                                        • Opcode ID: 1eac916fa5329d444605682d9d734c6a32ac560b1ceebdc3c7c447883829b9fd
                                                                                                                                                                                                                        • Instruction ID: defd549447870fa0f2ea5a15a164dc1829db5c685e7e668e78997428775fde9d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1eac916fa5329d444605682d9d734c6a32ac560b1ceebdc3c7c447883829b9fd
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F561A2715002018BEB509F68FC4AA2D7BE6BF01775F240724F866DA2D0EF76D826CB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00405C49 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 88COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                                                                                                                                                                                                        • Py_SetProgramName.PYTHON310 ref: 00405AEC
                                                                                                                                                                                                                        • Py_SetPythonHome.PYTHON310 ref: 00405B19
                                                                                                                                                                                                                        • Py_GetPath.PYTHON310 ref: 00405BA6
                                                                                                                                                                                                                        • Py_SetPath.PYTHON310 ref: 00405BB3
                                                                                                                                                                                                                        • Py_Initialize.PYTHON310 ref: 00405BC0
                                                                                                                                                                                                                        • PySys_SetPath.PYTHON310 ref: 00405BCD
                                                                                                                                                                                                                          • Part of subcall function 00408C20: calloc.MSVCRT ref: 00408C3D
                                                                                                                                                                                                                          • Part of subcall function 00408C20: free.MSVCRT ref: 00408C88
                                                                                                                                                                                                                          • Part of subcall function 00408C20: free.MSVCRT ref: 00408C96
                                                                                                                                                                                                                        • PySys_SetArgvEx.PYTHON310 ref: 00405C0A
                                                                                                                                                                                                                        • free.MSVCRT ref: 00405C26
                                                                                                                                                                                                                        • free.MSVCRT ref: 00405C34
                                                                                                                                                                                                                        • PyErr_Occurred.PYTHON310 ref: 00405C39
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: free$Path$Sys_$ArgvByteCharErr_HomeInitializeMultiNameOccurredProgramPythonWidecalloc
                                                                                                                                                                                                                        • String ID: 0$ 0$%s%c%s%c%s%c%s%c%s$;$;$Invalid value for PYTHONUTF8=%s; disabling utf-8 mode!$\$\$base_library.zip$lib-dynload
                                                                                                                                                                                                                        • API String ID: 486745808-2560864920
                                                                                                                                                                                                                        • Opcode ID: adbe956365aedb5869d1d07a265270035179c80d4643125045a902af79938b7f
                                                                                                                                                                                                                        • Instruction ID: 4f34d637e5975f622271dbaeae991fb6a0a455f2055f84ceed78d6860252850e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: adbe956365aedb5869d1d07a265270035179c80d4643125045a902af79938b7f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: EF414AB0609711DFE310AF21E94825BBBE4FF48344F41882EE9C997390D7B89586CF5A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00405AA1 Relevance: 33.3, APIs: 10, Strings: 9, Instructions: 86COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Path$Sys_free$ArgvErr_HomeInitializeNameOccurredProgramPython
                                                                                                                                                                                                                        • String ID: 0$ 0$%s%c%s%c%s%c%s%c%s$;$;$\$\$base_library.zip$lib-dynload
                                                                                                                                                                                                                        • API String ID: 364206270-729638271
                                                                                                                                                                                                                        • Opcode ID: ef64446728c2080087c71a493b58b8590e796b5ae5cde7a7036147615cfb8823
                                                                                                                                                                                                                        • Instruction ID: 1f7a57bb88f92124875474453c602a743d3be9c2356b80e19fcfa62188903238
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ef64446728c2080087c71a493b58b8590e796b5ae5cde7a7036147615cfb8823
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A74139B06097109FE310AF20E94825BBBE0FF44344F81882EE9C997390D7B89485CF5A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FEE4F0 Relevance: 31.8, APIs: 17, Strings: 1, Instructions: 300COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyObject_GetIter.PYTHON3(?), ref: 04FEE4FA
                                                                                                                                                                                                                        • PyErr_Clear.PYTHON3 ref: 04FEE510
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(00000000), ref: 04FEE52B
                                                                                                                                                                                                                        • PyType_GetFlags.PYTHON3(?), ref: 04FEE537
                                                                                                                                                                                                                        • PyErr_Clear.PYTHON3(00000004), ref: 04FEE57A
                                                                                                                                                                                                                        • PyIter_Next.PYTHON3(00000000), ref: 04FEE581
                                                                                                                                                                                                                        • ?detach_grow@QListData@@QAEPAUData@1@PAHH@Z.QT5CORE(?,00000001), ref: 04FEE5F9
                                                                                                                                                                                                                        • ?append@QListData@@QAEPAPAXXZ.QT5CORE ref: 04FEE697
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(00000000), ref: 04FEE6E7
                                                                                                                                                                                                                        • PyErr_Clear.PYTHON3 ref: 04FEE6F4
                                                                                                                                                                                                                        • PyIter_Next.PYTHON3(00000000), ref: 04FEE6FB
                                                                                                                                                                                                                        • PyErr_Occurred.PYTHON3 ref: 04FEE711
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(00000000,?,00000000), ref: 04FEE75D
                                                                                                                                                                                                                        • PyErr_Format.PYTHON3(6CFC9584,index %zd has type '%s' but 'QSize' is expected,?,00000000), ref: 04FEE79C
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(00000000), ref: 04FEE7BE
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(00000000,?,00000000), ref: 04FEE814
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(00000000), ref: 04FEE834
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • index %zd has type '%s' but 'QSize' is expected, xrefs: 04FEE795
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Dealloc$Err_$Clear$Data@@Iter_ListNext$?append@?detach_grow@Data@1@FlagsFormatIterObject_OccurredType_malloc
                                                                                                                                                                                                                        • String ID: index %zd has type '%s' but 'QSize' is expected
                                                                                                                                                                                                                        • API String ID: 3958736440-3766856804
                                                                                                                                                                                                                        • Opcode ID: f39bfa96c4074f80a09ffd55672712b857aaa054e5a9574331f2b4acea5c0e13
                                                                                                                                                                                                                        • Instruction ID: 7efaf2fae54344a357daab920675494a833f4d5f268c1d6f8d96cb01b9185a00
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f39bfa96c4074f80a09ffd55672712b857aaa054e5a9574331f2b4acea5c0e13
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CAB1DF716102019FDB10DF68EC85A2977E4FF88325F280A68F825CB390EB35E917CB91
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05014630 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 188COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PySequence_Check.PYTHON3(?), ref: 0501463F
                                                                                                                                                                                                                        • PyType_GetFlags.PYTHON3(?), ref: 0501464F
                                                                                                                                                                                                                        • PySequence_Size.PYTHON3(?), ref: 05014673
                                                                                                                                                                                                                        • PyErr_Format.PYTHON3(6CFC9584,sequence has %zd elements but 2 elements are expected,00000000), ref: 05014696
                                                                                                                                                                                                                        • PySequence_GetItem.PYTHON3(?,00000000), ref: 050146B5
                                                                                                                                                                                                                        • PyErr_Occurred.PYTHON3 ref: 050146E0
                                                                                                                                                                                                                        • PyErr_Format.PYTHON3(6CFC9584,the first element has type '%s' but 'QOpenGLTexture.Filter' is expected,00000000), ref: 05014707
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • sequence has %zd elements but 2 elements are expected, xrefs: 0501468F
                                                                                                                                                                                                                        • the second element has type '%s' but 'QOpenGLTexture.Filter' is expected, xrefs: 0501478B
                                                                                                                                                                                                                        • the first element has type '%s' but 'QOpenGLTexture.Filter' is expected, xrefs: 05014700
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Err_Sequence_$Format$CheckFlagsItemOccurredSizeType_
                                                                                                                                                                                                                        • String ID: sequence has %zd elements but 2 elements are expected$the first element has type '%s' but 'QOpenGLTexture.Filter' is expected$the second element has type '%s' but 'QOpenGLTexture.Filter' is expected
                                                                                                                                                                                                                        • API String ID: 289493104-3526451457
                                                                                                                                                                                                                        • Opcode ID: 03978150f12685e54cbf5d1ec8b2c69b027356672ee0fe4c07feea894be11a3f
                                                                                                                                                                                                                        • Instruction ID: 4104844723cb0632899850f8fe79ea0c2ba09377ae211bd057d00bee4f39ecaf
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 03978150f12685e54cbf5d1ec8b2c69b027356672ee0fe4c07feea894be11a3f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3051E6712102004FDB509FA8FC89A6D7BE1FF45721F240534F915CB2A0EF76A856DB56
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050164C0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 215COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyObject_GetIter.PYTHON3(?), ref: 050164CA
                                                                                                                                                                                                                        • PyErr_Clear.PYTHON3 ref: 050164DC
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(00000000), ref: 050164F7
                                                                                                                                                                                                                        • PyType_GetFlags.PYTHON3(?), ref: 05016503
                                                                                                                                                                                                                        • ?sharedNull@QArrayData@@SAPAU1@XZ.QT5CORE(00000004), ref: 05016539
                                                                                                                                                                                                                        • PyErr_Clear.PYTHON3 ref: 05016547
                                                                                                                                                                                                                        • PyIter_Next.PYTHON3(00000000), ref: 0501654E
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(00000000), ref: 050165D1
                                                                                                                                                                                                                        • PyErr_Clear.PYTHON3 ref: 050165DA
                                                                                                                                                                                                                        • PyIter_Next.PYTHON3(00000000), ref: 050165E1
                                                                                                                                                                                                                        • PyErr_Occurred.PYTHON3 ref: 050165F4
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(00000000,?,00000000), ref: 05016642
                                                                                                                                                                                                                        • PyErr_Format.PYTHON3(6CFC9584,index %zd has type '%s' but 'QTextLayout::FormatRange' is expected,?,00000000), ref: 0501667D
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(00000000), ref: 05016697
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(00000000,?,00000000), ref: 050166E4
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(00000000), ref: 05016704
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • index %zd has type '%s' but 'QTextLayout::FormatRange' is expected, xrefs: 05016676
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Dealloc$Err_$Clear$Iter_Next$?sharedArrayData@@FlagsFormatIterNull@Object_OccurredType_
                                                                                                                                                                                                                        • String ID: index %zd has type '%s' but 'QTextLayout::FormatRange' is expected
                                                                                                                                                                                                                        • API String ID: 2049041316-1769610038
                                                                                                                                                                                                                        • Opcode ID: 4c2d412fccad702687d59417ebeee46f0a297564b148f0b3aab918fdba4e5f61
                                                                                                                                                                                                                        • Instruction ID: f14b3f49e0e7f7f31bbea60694d3d30629c1dff5a6038935c948f21183a7464d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4c2d412fccad702687d59417ebeee46f0a297564b148f0b3aab918fdba4e5f61
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CE61AF716002018BDB509F38EC85A6E7BE1BF45734F280624FC65D72E0EB36D95A8B57
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00401BD0 Relevance: 29.9, APIs: 6, Strings: 11, Instructions: 151COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 00407DD0: strlen.MSVCRT ref: 00407E4A
                                                                                                                                                                                                                          • Part of subcall function 00407DD0: strtok.MSVCRT ref: 00407E5C
                                                                                                                                                                                                                          • Part of subcall function 00407DD0: strlen.MSVCRT ref: 00407E7B
                                                                                                                                                                                                                          • Part of subcall function 00407DD0: strlen.MSVCRT ref: 00407E8F
                                                                                                                                                                                                                          • Part of subcall function 00407DD0: strcpy.MSVCRT(?,?,00000000), ref: 00407EA3
                                                                                                                                                                                                                          • Part of subcall function 00407DD0: strtok.MSVCRT ref: 00407EB7
                                                                                                                                                                                                                          • Part of subcall function 00407DD0: _wstat.MSVCRT ref: 00407EE1
                                                                                                                                                                                                                        • malloc.MSVCRT ref: 00401C55
                                                                                                                                                                                                                        • fread.MSVCRT ref: 00401CF4
                                                                                                                                                                                                                        • free.MSVCRT ref: 00401D25
                                                                                                                                                                                                                        • fclose.MSVCRT ref: 00401D50
                                                                                                                                                                                                                        • fclose.MSVCRT ref: 00401D63
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00401E40
                                                                                                                                                                                                                        • Failed to extract %s: failed to write data chunk!, xrefs: 00401DC4
                                                                                                                                                                                                                        • Failed to extract %s: failed to seek to the entry's data!, xrefs: 00401DF4
                                                                                                                                                                                                                        • fread, xrefs: 00401D12
                                                                                                                                                                                                                        • fwrite, xrefs: 00401DD1
                                                                                                                                                                                                                        • fseek, xrefs: 00401E01
                                                                                                                                                                                                                        • Failed to extract %s: failed to open target file!, xrefs: 00401E1A
                                                                                                                                                                                                                        • fopen, xrefs: 00401E27
                                                                                                                                                                                                                        • Failed to extract %s: failed to open archive file!, xrefs: 00401DA4
                                                                                                                                                                                                                        • malloc, xrefs: 00401E4B
                                                                                                                                                                                                                        • Failed to extract %s: failed to read data chunk!, xrefs: 00401D05
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: strlen$fclosestrtok$_wstatfreadfreemallocstrcpy
                                                                                                                                                                                                                        • String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                                                                                                                        • API String ID: 3544345225-666925554
                                                                                                                                                                                                                        • Opcode ID: 08f377a39da0c69af000f18cf15a2aebcca8549d1e871d3055fab1c273705c1d
                                                                                                                                                                                                                        • Instruction ID: b5f998b2d191bd7786349188155599ad4440f4e1001f158a4c3b14c5a7e7e59c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 08f377a39da0c69af000f18cf15a2aebcca8549d1e871d3055fab1c273705c1d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5C510AB05093419BD710EF29C48465FBBE1BF84354F118D2EF8E59B391D778E8858B4A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00407940 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 126COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • _wputenv_s.MSVCRT ref: 0040798F
                                                                                                                                                                                                                        • free.MSVCRT ref: 0040799A
                                                                                                                                                                                                                        • GetTempPathW.KERNEL32(?,00000000,?,?,00407B92), ref: 004079BB
                                                                                                                                                                                                                        • _getpid.MSVCRT ref: 004079C4
                                                                                                                                                                                                                        • _wtempnam.MSVCRT ref: 004079F0
                                                                                                                                                                                                                        • free.MSVCRT ref: 00407A0B
                                                                                                                                                                                                                        • free.MSVCRT ref: 00407A3D
                                                                                                                                                                                                                          • Part of subcall function 00407650: GetEnvironmentVariableW.KERNEL32(00000000,00403DEA), ref: 0040768F
                                                                                                                                                                                                                          • Part of subcall function 004077C0: ExpandEnvironmentStringsW.KERNEL32(?,00000000,?,?,0040797A,?,00000000,?,?,00407B92), ref: 0040780C
                                                                                                                                                                                                                          • Part of subcall function 004077C0: free.MSVCRT ref: 0040781A
                                                                                                                                                                                                                          • Part of subcall function 004077C0: _wfullpath.MSVCRT ref: 0040784A
                                                                                                                                                                                                                          • Part of subcall function 004077C0: wcschr.MSVCRT ref: 00407877
                                                                                                                                                                                                                          • Part of subcall function 004077C0: wcsncpy.MSVCRT ref: 004078A7
                                                                                                                                                                                                                          • Part of subcall function 004077C0: CreateDirectoryW.KERNEL32 ref: 004078B7
                                                                                                                                                                                                                          • Part of subcall function 004077C0: wcschr.MSVCRT ref: 004078C7
                                                                                                                                                                                                                          • Part of subcall function 004077C0: CreateDirectoryW.KERNEL32 ref: 004078DD
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: free$CreateDirectoryEnvironmentwcschr$ExpandPathStringsTempVariable_getpid_wfullpath_wputenv_s_wtempnamwcsncpy
                                                                                                                                                                                                                        • String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
                                                                                                                                                                                                                        • API String ID: 2180377646-1116378104
                                                                                                                                                                                                                        • Opcode ID: 927dc99b90c32e611f2856e2e49529ac9b62f84a9827835374f0d536856b72f9
                                                                                                                                                                                                                        • Instruction ID: 01c5aea6ddf612d932d95327d8216bd8a762320b70d46ed771eeb73c9fc8ba7f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 927dc99b90c32e611f2856e2e49529ac9b62f84a9827835374f0d536856b72f9
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8E41CCB1A0D7008FD710BF65E58536FBBE0AF84744F02882EE5C897242D77D94859B9B
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0507C5F0 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 267windowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ??0QCursor@@QAE@ABVQBitmap@@0HH@Z.QT5GUI(?,?,?,?), ref: 0507C6A8
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Bitmap@@0Cursor@@malloc
                                                                                                                                                                                                                        • String ID: @J1$J9J9|ii$J9|ii
                                                                                                                                                                                                                        • API String ID: 2952291190-1482288198
                                                                                                                                                                                                                        • Opcode ID: a849aa7f737589d5c9516c700642dfb113039494748f4f581052fd009f26bac6
                                                                                                                                                                                                                        • Instruction ID: e0639a4f331a17c1db39589518d6ace10bf91a74d94cfff14a4f5ea0fe793ead
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a849aa7f737589d5c9516c700642dfb113039494748f4f581052fd009f26bac6
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8C91C6726043019FE740DFA4EC45EAF7BE9FB84360F040569FA1587291DB35E94ACBA2
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00408D40 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 108COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(?,?,?,?,?,00000005,?,?,00000000,00407A00), ref: 00408D68
                                                                                                                                                                                                                        • OpenProcessToken.ADVAPI32(?,?,?,?,?,00000005,?,?,00000000,00407A00), ref: 00408D81
                                                                                                                                                                                                                        • free.MSVCRT ref: 00408D9F
                                                                                                                                                                                                                        • CloseHandle.KERNEL32 ref: 00408DB0
                                                                                                                                                                                                                        • _snwprintf.MSVCRT ref: 00408DDE
                                                                                                                                                                                                                        • LocalFree.KERNEL32 ref: 00408DE7
                                                                                                                                                                                                                        • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00408E1B
                                                                                                                                                                                                                        • CreateDirectoryW.KERNEL32 ref: 00408E3A
                                                                                                                                                                                                                        • GetTokenInformation.ADVAPI32 ref: 00408E89
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 00408E92
                                                                                                                                                                                                                        • calloc.MSVCRT ref: 00408EB0
                                                                                                                                                                                                                        • GetTokenInformation.ADVAPI32 ref: 00408EDA
                                                                                                                                                                                                                        • ConvertSidToStringSidW.ADVAPI32 ref: 00408EF4
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen_snwprintfcallocfree
                                                                                                                                                                                                                        • String ID: D:(A;;FA;;;%s)$S-1-3-4
                                                                                                                                                                                                                        • API String ID: 1339360106-2855260032
                                                                                                                                                                                                                        • Opcode ID: 20fa4f3d988aa03e25c24d4b52e570da4e7e5180fc1b205961bb6a5cec14814b
                                                                                                                                                                                                                        • Instruction ID: 945ac7356c52e091193055c5d6ee7abddb38f98d0a82e690350cb517e8796f62
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 20fa4f3d988aa03e25c24d4b52e570da4e7e5180fc1b205961bb6a5cec14814b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2E41C4B05083009FE700AF69D68825EBBE4BF84755F418E2EF8D9A7291D778D548CF86
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040E660 Relevance: 25.7, APIs: 17, Instructions: 174COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: setlocale$wcstombs$_strdupfreerealloc
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2293806352-0
                                                                                                                                                                                                                        • Opcode ID: 9dd92505955bcef7c0158eea0a81386eeefa2c3a7dcaf571075d4c2b4108fbf2
                                                                                                                                                                                                                        • Instruction ID: 1138b9a49e69c7a07146da18e6cbb8f4c5af7b9e580f31b8634df38c7834fdfb
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9dd92505955bcef7c0158eea0a81386eeefa2c3a7dcaf571075d4c2b4108fbf2
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 036130709082119BCB10AF66C44536FBBE1EF94344F468D3FE488A7391E77C8891DB9A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0500A4E0 Relevance: 24.7, APIs: 7, Strings: 7, Instructions: 176COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?insertImage@QTextCursor@@QAEXABVQTextImageFormat@@@Z.QT5GUI(?), ref: 0500A53C
                                                                                                                                                                                                                        • ?insertImage@QTextCursor@@QAEXABVQTextImageFormat@@W4Position@QTextFrameFormat@@@Z.QT5GUI(?,?), ref: 0500A59D
                                                                                                                                                                                                                        • ??0?$QVector@VQPoint@@@@QAE@XZ.QT5CORE ref: 0500A63B
                                                                                                                                                                                                                        • ?insertImage@QTextCursor@@QAEXABVQImage@@ABVQString@@@Z.QT5GUI(?,?), ref: 0500A6AF
                                                                                                                                                                                                                        • ??1QString@@QAE@XZ.QT5CORE ref: 0500A6EC
                                                                                                                                                                                                                        • ??1QString@@QAE@XZ.QT5CORE ref: 0500A6FE
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • BJ9E, xrefs: 0500A56D
                                                                                                                                                                                                                        • BJ9|J1, xrefs: 0500A67C
                                                                                                                                                                                                                        • BJ1, xrefs: 0500A5CD
                                                                                                                                                                                                                        • insertImage(self, format: QTextImageFormat)insertImage(self, format: QTextImageFormat, alignment: QTextFrameFormat.Position)insertImage(self, name: Optional[str])insertImage(self, image: QImage, name: Optional[str] = ''), xrefs: 0500A709
                                                                                                                                                                                                                        • QTextCursor, xrefs: 0500A713
                                                                                                                                                                                                                        • insertImage, xrefs: 0500A70E
                                                                                                                                                                                                                        • BJ9, xrefs: 0500A510
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Text$?insertCursor@@Image@$Format@@@ImageString@@$??0?$Format@@FrameImage@@Point@@@@Position@String@@@Vector@
                                                                                                                                                                                                                        • String ID: BJ1$BJ9$BJ9E$BJ9|J1$QTextCursor$insertImage$insertImage(self, format: QTextImageFormat)insertImage(self, format: QTextImageFormat, alignment: QTextFrameFormat.Position)insertImage(self, name: Optional[str])insertImage(self, image: QImage, name: Optional[str] = '')
                                                                                                                                                                                                                        • API String ID: 1741501586-292677817
                                                                                                                                                                                                                        • Opcode ID: 9e0d2cbe16f0e9fc2b6c284c7efde48d6c24edbf1b443bcbca45e57d36fc62df
                                                                                                                                                                                                                        • Instruction ID: eb30ca63d29ab07fb67831f4272e1e4935342adcb3c576c0c30ce9f8beb7d3d0
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9e0d2cbe16f0e9fc2b6c284c7efde48d6c24edbf1b443bcbca45e57d36fc62df
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5C614E71218306AFE741DF54EC41EAA7BF9FB88700F040829F955D32A0DB71E959DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00408190 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 107processsynchronizationCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                                                                                                                                                                                                        • SetConsoleCtrlHandler.KERNEL32(00000000,?,00000000,?,00404169), ref: 004081DB
                                                                                                                                                                                                                        • GetStartupInfoW.KERNEL32 ref: 00408203
                                                                                                                                                                                                                        • _fileno.MSVCRT ref: 0040824E
                                                                                                                                                                                                                        • _get_osfhandle.MSVCRT ref: 0040825C
                                                                                                                                                                                                                        • _fileno.MSVCRT ref: 00408277
                                                                                                                                                                                                                        • _get_osfhandle.MSVCRT ref: 0040827F
                                                                                                                                                                                                                        • _fileno.MSVCRT ref: 0040829A
                                                                                                                                                                                                                        • _get_osfhandle.MSVCRT ref: 004082A2
                                                                                                                                                                                                                        • GetCommandLineW.KERNEL32 ref: 004082B1
                                                                                                                                                                                                                        • CreateProcessW.KERNEL32 ref: 00408301
                                                                                                                                                                                                                        • WaitForSingleObject.KERNEL32 ref: 0040831D
                                                                                                                                                                                                                        • GetExitCodeProcess.KERNEL32 ref: 00408335
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: _fileno_get_osfhandle$Process$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
                                                                                                                                                                                                                        • String ID: CreateProcessW$Error creating child process!
                                                                                                                                                                                                                        • API String ID: 1833775142-3524285272
                                                                                                                                                                                                                        • Opcode ID: 32d5236159ff9933d5b80ff1d926fdea5f1ce6c1af8ead61a65d3641c3c49501
                                                                                                                                                                                                                        • Instruction ID: e1b98e6d24d483291a0d25806d4a7f2563c0c3411ac3d46acccf3020f7941406
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 32d5236159ff9933d5b80ff1d926fdea5f1ce6c1af8ead61a65d3641c3c49501
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E14195B05083448FD710AF69D58935EBBF0BF84314F418E2EE8D887291D7B99488CF96
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00402B80 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 81windowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: _wcsdupfree$DeleteDestroyDialogHandleIconIndirectModuleObjectParammemset
                                                                                                                                                                                                                        • String ID: 8 $@$Unhandled exception in script
                                                                                                                                                                                                                        • API String ID: 3963799495-1206599369
                                                                                                                                                                                                                        • Opcode ID: 47d42c7bf4735e15dde57d63418aef27060c31eb55eeab7a34c0ce7b6333cf64
                                                                                                                                                                                                                        • Instruction ID: 5f7a7bfca591e00baa7cae047d41d3b5615dab244da7dd9e67f68e2e3487ae70
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 47d42c7bf4735e15dde57d63418aef27060c31eb55eeab7a34c0ce7b6333cf64
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C231E5B05087409FD750EF69D48969FBBE4AF89348F428D2EE58897350DB78D488CB86
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05046540 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 272COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?boundingRect@QPainter@@QAE?AVQRectF@@ABV2@HABVQString@@@Z.QT5GUI(00000000,?,?,?), ref: 050465CC
                                                                                                                                                                                                                        • ?boundingRect@QPainter@@QAE?AVQRect@@ABV2@HABVQString@@@Z.QT5GUI(00000000,?,?,?), ref: 05046680
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • BiiiiiJ1, xrefs: 050467E5
                                                                                                                                                                                                                        • BJ9iJ1, xrefs: 0504658D, 05046641
                                                                                                                                                                                                                        • BJ9J1|J9, xrefs: 0504670D
                                                                                                                                                                                                                        • boundingRect, xrefs: 05046891
                                                                                                                                                                                                                        • boundingRect(self, rect: QRectF, flags: int, text: Optional[str]) -> QRectFboundingRect(self, rect: QRect, flags: int, text: Optional[str]) -> QRectboundingRect(self, rectangle: QRectF, text: Optional[str], option: QTextOption = QTextOption()) -> QRectFboun, xrefs: 0504688C
                                                                                                                                                                                                                        • QPainter, xrefs: 05046896
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?boundingPainter@@Rect@String@@@$RectRect@@malloc
                                                                                                                                                                                                                        • String ID: BJ9J1|J9$BJ9iJ1$BiiiiiJ1$QPainter$boundingRect$boundingRect(self, rect: QRectF, flags: int, text: Optional[str]) -> QRectFboundingRect(self, rect: QRect, flags: int, text: Optional[str]) -> QRectboundingRect(self, rectangle: QRectF, text: Optional[str], option: QTextOption = QTextOption()) -> QRectFboun
                                                                                                                                                                                                                        • API String ID: 2982346787-1237817499
                                                                                                                                                                                                                        • Opcode ID: 2966b363ca985e5d2b074b1938396c4405531431c20c12a22fb53755bdf2a389
                                                                                                                                                                                                                        • Instruction ID: 8a590ccb4aa27497727f44f2ecdfb29e25fafc649190c75353d925c71282a3df
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2966b363ca985e5d2b074b1938396c4405531431c20c12a22fb53755bdf2a389
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CAA15072108305AFDB11DF94DC41EABBBE9FB88314F040829FA4593260DB71EA99DF52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FE8650 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 159COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyTuple_Size.PYTHON3(?), ref: 04FE86BC
                                                                                                                                                                                                                        • PyTuple_Size.PYTHON3(?,00000000), ref: 04FE86F7
                                                                                                                                                                                                                        • PyTuple_GetItem.PYTHON3(?,00000000), ref: 04FE8715
                                                                                                                                                                                                                        • PyLong_AsLong.PYTHON3(00000000), ref: 04FE8718
                                                                                                                                                                                                                        • PyTuple_Size.PYTHON3(?), ref: 04FE8724
                                                                                                                                                                                                                        • ?putPoints@QPolygon@@QAEXHHPBH@Z.QT5GUI(?,?,00000000), ref: 04FE8743
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(?), ref: 04FE876C
                                                                                                                                                                                                                        • ?putPoints@QPolygon@@QAEXHHABV1@H@Z.QT5GUI(?,?,?,?), ref: 04FE87DF
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • BiiiW, xrefs: 04FE8689
                                                                                                                                                                                                                        • BiiJ9|i, xrefs: 04FE87A4
                                                                                                                                                                                                                        • putPoints, xrefs: 04FE880C
                                                                                                                                                                                                                        • putPoints(self, index: int, firstx: int, firsty: int, *args: int)putPoints(self, index: int, nPoints: int, fromPolygon: QPolygon, from_: int = 0), xrefs: 04FE8807
                                                                                                                                                                                                                        • QPolygon, xrefs: 04FE8811
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Tuple_$Size$?putPoints@Polygon@@$DeallocItemLongLong_
                                                                                                                                                                                                                        • String ID: BiiJ9|i$BiiiW$QPolygon$putPoints$putPoints(self, index: int, firstx: int, firsty: int, *args: int)putPoints(self, index: int, nPoints: int, fromPolygon: QPolygon, from_: int = 0)
                                                                                                                                                                                                                        • API String ID: 511338698-3993591335
                                                                                                                                                                                                                        • Opcode ID: fa4d3885b4358da201fc6dc1f5f99026f420354982a872789c1ba7cb2e700e86
                                                                                                                                                                                                                        • Instruction ID: bc168a3c7653073f4268251df4a2980486915dbc1dea389a50db8914bb241c0d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: fa4d3885b4358da201fc6dc1f5f99026f420354982a872789c1ba7cb2e700e86
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BE51B172104201AFD300DF65CC81EABBBE9FF88754F140929F999D32A0DB35E946CB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00405490 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 133COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to convert Wflag %s using mbstowcs (invalid multibyte string), xrefs: 00405697
                                                                                                                                                                                                                        • pyi-, xrefs: 00405554
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: Failed to convert Wflag %s using mbstowcs (invalid multibyte string)$pyi-
                                                                                                                                                                                                                        • API String ID: 0-3625900369
                                                                                                                                                                                                                        • Opcode ID: b82ee6a41f0246c7b60d63f8347de0f5df44efc621638f2d70a5ca26f7bbdf59
                                                                                                                                                                                                                        • Instruction ID: 53111416b2da41d66908906ea93154b7d6de6c86b10f1f3900d8cec0b1898ba9
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b82ee6a41f0246c7b60d63f8347de0f5df44efc621638f2d70a5ca26f7bbdf59
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 33513CB05097009FD710AF65D98476ABBE0FB45304F82482EE8C8AB391D3BDD885CF5A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004077C0 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 101COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                                                                                                                                                                                                        • ExpandEnvironmentStringsW.KERNEL32(?,00000000,?,?,0040797A,?,00000000,?,?,00407B92), ref: 0040780C
                                                                                                                                                                                                                        • free.MSVCRT ref: 0040781A
                                                                                                                                                                                                                          • Part of subcall function 00408FA0: wcslen.MSVCRT ref: 00408FAC
                                                                                                                                                                                                                        • _wfullpath.MSVCRT ref: 0040784A
                                                                                                                                                                                                                        • wcschr.MSVCRT ref: 00407877
                                                                                                                                                                                                                        • wcsncpy.MSVCRT ref: 004078A7
                                                                                                                                                                                                                        • CreateDirectoryW.KERNEL32 ref: 004078B7
                                                                                                                                                                                                                        • wcschr.MSVCRT ref: 004078C7
                                                                                                                                                                                                                        • CreateDirectoryW.KERNEL32 ref: 004078DD
                                                                                                                                                                                                                        • _wcsdup.MSVCRT ref: 004078F3
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00407920
                                                                                                                                                                                                                        • LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 0040792E
                                                                                                                                                                                                                        • LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00407900
                                                                                                                                                                                                                        • \, xrefs: 004078BF
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CreateDirectorywcschr$ByteCharEnvironmentExpandMultiStringsWide_wcsdup_wfullpathfreewcslenwcsncpy
                                                                                                                                                                                                                        • String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.$\
                                                                                                                                                                                                                        • API String ID: 274989731-3296995943
                                                                                                                                                                                                                        • Opcode ID: f389d4807b938e55ecb376f0f53028c8ff9e65046959c3115b4ca1d10331afd9
                                                                                                                                                                                                                        • Instruction ID: b23a07802ca04ce963d90eb9615f597fb6c60bb1e29e7f7f3b36ce21c54aa4ff
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f389d4807b938e55ecb376f0f53028c8ff9e65046959c3115b4ca1d10331afd9
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1C315DB1A087018BD3107F69D94935FBAE4BF84344F05883EE9C897381DB79D8459B8B
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00408E58 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 86COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ConvertDescriptorInformationSecurityStringToken$CloseCreateDirectoryErrorFreeHandleLastLocal_snwprintfcallocfree
                                                                                                                                                                                                                        • String ID: D:(A;;FA;;;%s)$S-1-3-4
                                                                                                                                                                                                                        • API String ID: 2426448178-2855260032
                                                                                                                                                                                                                        • Opcode ID: cbc9b7a7022e2090bf5412f5cba968d65ad33e5ede0d00afb860ea90c6cf80a8
                                                                                                                                                                                                                        • Instruction ID: 5ee2362bb1dffc1b92a9066ae5264b9d3527a87a2536074db898feb824fd9f33
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: cbc9b7a7022e2090bf5412f5cba968d65ad33e5ede0d00afb860ea90c6cf80a8
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8C31D3B05083009FE700AF69D68835EBBE0FF84715F01892EE8D9972A1D778D988CF46
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00405E00 Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 56stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Unicode_$AppendDecodeFormatFromList_ObjectSys_strlen
                                                                                                                                                                                                                        • String ID: %U?%llu$Failed to append to sys.path$Installing PYZ: Could not get sys.path$path$strict$utf-8
                                                                                                                                                                                                                        • API String ID: 442992809-2762566162
                                                                                                                                                                                                                        • Opcode ID: 0a30e1c31abfe84ab274ddb6d250ee1ed9747d53d1c92cc8e44e52a44ddb55f5
                                                                                                                                                                                                                        • Instruction ID: 2414ad3c8f8d3fc0fbc978f46c10fd6a42ce83d48acf707811ed1e666cf8afaa
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0a30e1c31abfe84ab274ddb6d250ee1ed9747d53d1c92cc8e44e52a44ddb55f5
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6A112EB05093009FC710AF69DA8801EBBE4FF84354F45882EE5D897341D7B88481CF9B
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00403370 Relevance: 22.7, APIs: 2, Strings: 13, Instructions: 220stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 004032F0: strchr.MSVCRT ref: 0040332F
                                                                                                                                                                                                                          • Part of subcall function 004032F0: strcpy.MSVCRT ref: 00403345
                                                                                                                                                                                                                        • strcmp.MSVCRT ref: 0040351A
                                                                                                                                                                                                                          • Part of subcall function 00407FD0: feof.MSVCRT ref: 00408033
                                                                                                                                                                                                                          • Part of subcall function 00407FD0: fread.MSVCRT ref: 00408057
                                                                                                                                                                                                                          • Part of subcall function 00407FD0: ferror.MSVCRT ref: 00408063
                                                                                                                                                                                                                          • Part of subcall function 00407FD0: clearerr.MSVCRT ref: 00408074
                                                                                                                                                                                                                          • Part of subcall function 00407FD0: fclose.MSVCRT ref: 004080B8
                                                                                                                                                                                                                          • Part of subcall function 00407FD0: fclose.MSVCRT ref: 004080C0
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: fclose$clearerrfeofferrorfreadstrchrstrcmpstrcpy
                                                                                                                                                                                                                        • String ID: %s%c%s$%s%c%s%c%s$%s%c%s%c%s%c%s$%s%c%s.exe$%s%c%s.pkg$Archive not found: %s$Archive path exceeds PATH_MAX$Failed to copy %s$Failed to extract %s$Failed to open archive %s!$\$\$\
                                                                                                                                                                                                                        • API String ID: 3546371548-4129990315
                                                                                                                                                                                                                        • Opcode ID: 2745f0228d78fa06d22c06bd4220cdf573474b19550bea2584d5a11ea4fe38bb
                                                                                                                                                                                                                        • Instruction ID: 8a7e982486c7dae7ba286fda290711f8ff69515a3f7b07f7f3724835a8bf7877
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2745f0228d78fa06d22c06bd4220cdf573474b19550bea2584d5a11ea4fe38bb
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 67A126B0508701AFC710EF26C58415FBBE8BF84755F408A2EF498A7390D778DA858F8A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00403D60 Relevance: 21.3, APIs: 6, Strings: 6, Instructions: 316stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 004021E0: calloc.MSVCRT ref: 004021F2
                                                                                                                                                                                                                          • Part of subcall function 004045D0: GetModuleFileNameW.KERNEL32(00000000,00403DA0), ref: 004045F4
                                                                                                                                                                                                                        • fclose.MSVCRT ref: 00404245
                                                                                                                                                                                                                          • Part of subcall function 00404670: strcpy.MSVCRT(?,-00000004,00720E1C,00000002,?,00401600), ref: 00404683
                                                                                                                                                                                                                          • Part of subcall function 00404670: strlen.MSVCRT ref: 0040468B
                                                                                                                                                                                                                          • Part of subcall function 00407650: GetEnvironmentVariableW.KERNEL32(00000000,00403DEA), ref: 0040768F
                                                                                                                                                                                                                        • free.MSVCRT ref: 00403E26
                                                                                                                                                                                                                          • Part of subcall function 00407770: SetEnvironmentVariableW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0040D7CA), ref: 0040779E
                                                                                                                                                                                                                          • Part of subcall function 00407770: free.MSVCRT(?,?,-00000004,00720E1C,00000002,?,00401600), ref: 004077AC
                                                                                                                                                                                                                        • SetDllDirectoryW.KERNEL32 ref: 00403EA2
                                                                                                                                                                                                                        • strcmp.MSVCRT ref: 00403EDB
                                                                                                                                                                                                                        • strcpy.MSVCRT ref: 00403F28
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: EnvironmentVariablefreestrcpy$DirectoryFileModuleNamecallocfclosestrcmpstrlen
                                                                                                                                                                                                                        • String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
                                                                                                                                                                                                                        • API String ID: 3041748488-3602715111
                                                                                                                                                                                                                        • Opcode ID: 768be83e8ff3a33b0980ba9665766b318ff6543d5b006575faa26a0d4c761c3c
                                                                                                                                                                                                                        • Instruction ID: 81834f9b1efb18d84d1230dad00edf6ea56ed27c7a1d01e0e46bb9e00272f83c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 768be83e8ff3a33b0980ba9665766b318ff6543d5b006575faa26a0d4c761c3c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0FD1F8B09097018AD710AF75D58425FBBE8AF84345F01893FE9D8A7381E738D985CF96
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0503C4F0 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 187COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?drawEllipse@QPainter@@QAEXABVQRectF@@@Z.QT5GUI(?), ref: 0503C542
                                                                                                                                                                                                                        • ?drawEllipse@QPainter@@QAEXABVQRect@@@Z.QT5GUI(?), ref: 0503C58F
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Biiii, xrefs: 0503C5BE
                                                                                                                                                                                                                        • BJ9ii, xrefs: 0503C6FA
                                                                                                                                                                                                                        • drawEllipse(self, r: QRectF)drawEllipse(self, r: QRect)drawEllipse(self, x: int, y: int, w: int, h: int)drawEllipse(self, center: Union[QPointF, QPoint], rx: float, ry: float)drawEllipse(self, center: QPoint, rx: int, ry: int), xrefs: 0503C750
                                                                                                                                                                                                                        • BJ9, xrefs: 0503C51B, 0503C568
                                                                                                                                                                                                                        • drawEllipse, xrefs: 0503C755
                                                                                                                                                                                                                        • QPainter, xrefs: 0503C75A
                                                                                                                                                                                                                        • BJ1dd, xrefs: 0503C649
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?drawEllipse@Painter@@$F@@@RectRect@@@
                                                                                                                                                                                                                        • String ID: BJ1dd$BJ9$BJ9ii$Biiii$QPainter$drawEllipse$drawEllipse(self, r: QRectF)drawEllipse(self, r: QRect)drawEllipse(self, x: int, y: int, w: int, h: int)drawEllipse(self, center: Union[QPointF, QPoint], rx: float, ry: float)drawEllipse(self, center: QPoint, rx: int, ry: int)
                                                                                                                                                                                                                        • API String ID: 1121840852-2534475001
                                                                                                                                                                                                                        • Opcode ID: dcca634453da152dd94f55764ec164f4200b4d8971d0cc6a0a6dc1b4cb649cf3
                                                                                                                                                                                                                        • Instruction ID: 59015a700b8562d2446188ce089716f1acc803f2cab863f66b2b4b85fca69a73
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: dcca634453da152dd94f55764ec164f4200b4d8971d0cc6a0a6dc1b4cb649cf3
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 11711971118306AFD701CF95D881DABBBEDFF88254F04492AF959D3260EB70E9898B52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00407DD0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 122stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • WARNING: file already exists but should not: %s, xrefs: 00407F5B
                                                                                                                                                                                                                        • PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00407F82
                                                                                                                                                                                                                        • ERROR: file already exists but should not: %s, xrefs: 00407EF9
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: strlen$_wstatstrtok$ByteCharMultiWidefreestrcpy
                                                                                                                                                                                                                        • String ID: ERROR: file already exists but should not: %s$PYINSTALLER_STRICT_UNPACK_MODE$WARNING: file already exists but should not: %s
                                                                                                                                                                                                                        • API String ID: 439695417-1996835591
                                                                                                                                                                                                                        • Opcode ID: ae956383a1602fbf16243ccfb6895fa433991ee32204bf530d7f01d15dce0662
                                                                                                                                                                                                                        • Instruction ID: 0d1752cbd12df257bbbd412badab65e831f2b54a7211b67fa555c1920da682f5
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ae956383a1602fbf16243ccfb6895fa433991ee32204bf530d7f01d15dce0662
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: DE411CB050D7019AD310AF25D58429EBBE4EF84748F42883EE5C897391DB7CA4849B9B
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05044500 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 96COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ??0?$QVector@VQPoint@@@@QAE@XZ.QT5CORE ref: 0504456F
                                                                                                                                                                                                                        • ?begin@?$QVector@VQPoint@@@@QBEPBVQPoint@@XZ.QT5CORE ref: 05044593
                                                                                                                                                                                                                        • ?receivers@QObject@@IBEHPBD@Z.QT5CORE(00000000), ref: 0504459E
                                                                                                                                                                                                                        • ??1QByteArray@@QAE@XZ.QT5CORE ref: 050445CE
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(00000000), ref: 050445E0
                                                                                                                                                                                                                        • ??1QByteArray@@QAE@XZ.QT5CORE ref: 050445EF
                                                                                                                                                                                                                        • ??1QByteArray@@QAE@XZ.QT5CORE ref: 05044616
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Array@@Byte$Point@@@@Vector@$??0?$?begin@?$?receivers@FromLongLong_Object@@Point@@
                                                                                                                                                                                                                        • String ID: BP0$QRasterWindow$pyqt5_get_signal_signature$receivers$receivers(self, signal: PYQT_SIGNAL) -> int
                                                                                                                                                                                                                        • API String ID: 4090807617-2859287736
                                                                                                                                                                                                                        • Opcode ID: 084d2904f9eecf0fd66cebeef993e7adb46e3a9c76dd83ee2d9e70e80ef44aef
                                                                                                                                                                                                                        • Instruction ID: 3dc54c7affd9c96a724b25b41a9a9823a58b971828e93bb7924a0f6ea4998dd7
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 084d2904f9eecf0fd66cebeef993e7adb46e3a9c76dd83ee2d9e70e80ef44aef
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3B31A171514201AFDB01DBA4ED86EAE7BE5FF88310F440828F949C3251EB74ED59CB92
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05048460 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 96COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ??0?$QVector@VQPoint@@@@QAE@XZ.QT5CORE ref: 050484CF
                                                                                                                                                                                                                        • ?begin@?$QVector@VQPoint@@@@QBEPBVQPoint@@XZ.QT5CORE ref: 050484F3
                                                                                                                                                                                                                        • ?receivers@QObject@@IBEHPBD@Z.QT5CORE(00000000), ref: 050484FE
                                                                                                                                                                                                                        • ??1QByteArray@@QAE@XZ.QT5CORE ref: 0504852E
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(00000000), ref: 05048540
                                                                                                                                                                                                                        • ??1QByteArray@@QAE@XZ.QT5CORE ref: 0504854F
                                                                                                                                                                                                                        • ??1QByteArray@@QAE@XZ.QT5CORE ref: 05048576
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Array@@Byte$Point@@@@Vector@$??0?$?begin@?$?receivers@FromLongLong_Object@@Point@@
                                                                                                                                                                                                                        • String ID: BP0$QRegularExpressionValidator$pyqt5_get_signal_signature$receivers$receivers(self, signal: PYQT_SIGNAL) -> int
                                                                                                                                                                                                                        • API String ID: 4090807617-504698696
                                                                                                                                                                                                                        • Opcode ID: 8d3c4d2749ce593cc2232226693919ff0e71cbe6cd264165ab446f3af9d82301
                                                                                                                                                                                                                        • Instruction ID: c1a57c2ba9fca6b7a4454c675e8c8272aa0fdbc60987d505e59d1ade3af48835
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8d3c4d2749ce593cc2232226693919ff0e71cbe6cd264165ab446f3af9d82301
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 81317C71504201AFDB01DFA8ED46DAE7BE4FF88310F444868F949C3261EB34EA49CB92
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FE6560 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 96COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ??0?$QVector@VQPoint@@@@QAE@XZ.QT5CORE ref: 04FE65CF
                                                                                                                                                                                                                        • ?begin@?$QVector@VQPoint@@@@QBEPBVQPoint@@XZ.QT5CORE ref: 04FE65F3
                                                                                                                                                                                                                        • ?receivers@QObject@@IBEHPBD@Z.QT5CORE(00000000), ref: 04FE65FE
                                                                                                                                                                                                                        • ??1QByteArray@@QAE@XZ.QT5CORE ref: 04FE662E
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(00000000), ref: 04FE6640
                                                                                                                                                                                                                        • ??1QByteArray@@QAE@XZ.QT5CORE ref: 04FE664F
                                                                                                                                                                                                                        • ??1QByteArray@@QAE@XZ.QT5CORE ref: 04FE6676
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Array@@Byte$Point@@@@Vector@$??0?$?begin@?$?receivers@FromLongLong_Object@@Point@@
                                                                                                                                                                                                                        • String ID: BP0$QStandardItemModel$pyqt5_get_signal_signature$receivers$receivers(self, signal: PYQT_SIGNAL) -> int
                                                                                                                                                                                                                        • API String ID: 4090807617-3326890844
                                                                                                                                                                                                                        • Opcode ID: 50aa73f491d4d26358467664b728f08b6e26e273d82245e1cc5b527982bd0381
                                                                                                                                                                                                                        • Instruction ID: 624b3d07730fb52c08f479295957c2ecc7d4e76d1f111571bd4ffb9d607364e3
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 50aa73f491d4d26358467664b728f08b6e26e273d82245e1cc5b527982bd0381
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4031B071514201AFEB01DFA4ED46DAA7BE4FB98311F440828F949C7261EB35EA49CB92
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050807F0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 96COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ??0?$QVector@VQPoint@@@@QAE@XZ.QT5CORE ref: 0508085F
                                                                                                                                                                                                                        • ?begin@?$QVector@VQPoint@@@@QBEPBVQPoint@@XZ.QT5CORE ref: 05080883
                                                                                                                                                                                                                        • ?receivers@QObject@@IBEHPBD@Z.QT5CORE(00000000), ref: 0508088E
                                                                                                                                                                                                                        • ??1QByteArray@@QAE@XZ.QT5CORE ref: 050808BE
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(00000000), ref: 050808D0
                                                                                                                                                                                                                        • ??1QByteArray@@QAE@XZ.QT5CORE ref: 050808DF
                                                                                                                                                                                                                        • ??1QByteArray@@QAE@XZ.QT5CORE ref: 05080906
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Array@@Byte$Point@@@@Vector@$??0?$?begin@?$?receivers@FromLongLong_Object@@Point@@
                                                                                                                                                                                                                        • String ID: BP0$QOpenGLContext$pyqt5_get_signal_signature$receivers$receivers(self, signal: PYQT_SIGNAL) -> int
                                                                                                                                                                                                                        • API String ID: 4090807617-900810613
                                                                                                                                                                                                                        • Opcode ID: 11612c192b9c650e82712276f57a3989b93dba8b580f8f86260d520bfcfaf93d
                                                                                                                                                                                                                        • Instruction ID: 1d70472fc1853b75cd18b183d91e4ce00bb7798e6f600c78b9768016062f1493
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 11612c192b9c650e82712276f57a3989b93dba8b580f8f86260d520bfcfaf93d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8C319235504201AFD701EBA4ED4ADBE7BE4FB84710F444869F985C3251EB34DE89CB92
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0505A690 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 96COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ??0?$QVector@VQPoint@@@@QAE@XZ.QT5CORE ref: 0505A6FF
                                                                                                                                                                                                                        • ?begin@?$QVector@VQPoint@@@@QBEPBVQPoint@@XZ.QT5CORE ref: 0505A723
                                                                                                                                                                                                                        • ?receivers@QObject@@IBEHPBD@Z.QT5CORE(00000000), ref: 0505A72E
                                                                                                                                                                                                                        • ??1QByteArray@@QAE@XZ.QT5CORE ref: 0505A75E
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(00000000), ref: 0505A770
                                                                                                                                                                                                                        • ??1QByteArray@@QAE@XZ.QT5CORE ref: 0505A77F
                                                                                                                                                                                                                        • ??1QByteArray@@QAE@XZ.QT5CORE ref: 0505A7A6
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Array@@Byte$Point@@@@Vector@$??0?$?begin@?$?receivers@FromLongLong_Object@@Point@@
                                                                                                                                                                                                                        • String ID: BP0$QTextList$pyqt5_get_signal_signature$receivers$receivers(self, signal: PYQT_SIGNAL) -> int
                                                                                                                                                                                                                        • API String ID: 4090807617-2161664726
                                                                                                                                                                                                                        • Opcode ID: 92dc8f5a8b0f62e959d6ecfef9a66b5b69ef883337e06d429aa3dc51c52d2c4f
                                                                                                                                                                                                                        • Instruction ID: a642b17e48eb1e6260351d3b55f15d9a07022217b7008febce3d992df7a2b77b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 92dc8f5a8b0f62e959d6ecfef9a66b5b69ef883337e06d429aa3dc51c52d2c4f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F6318F31604201AFD701DBA4ED46DAF7BE5FB88311F444868FD59C3251EB35E989CB92
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00405907 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 88COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Fatal error: unable to decode the command line argument #%i, xrefs: 004059EB
                                                                                                                                                                                                                        • out of memory, xrefs: 00405A3A
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: free$setlocale$DecodeLocale_strdupcalloc
                                                                                                                                                                                                                        • String ID: Fatal error: unable to decode the command line argument #%i$out of memory
                                                                                                                                                                                                                        • API String ID: 474172956-3355598041
                                                                                                                                                                                                                        • Opcode ID: 82e1e586b294b392402f47a5caf2ca513f1388d1a5a1a0f0118e5191c02fd9f6
                                                                                                                                                                                                                        • Instruction ID: 3c8cf5d1830a856620667b4546970957c4b2e71bcab9539e8d8fe080ce2f005d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 82e1e586b294b392402f47a5caf2ca513f1388d1a5a1a0f0118e5191c02fd9f6
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BD313AB16087118FD710AF69E58526FBBE0EF40318F06482EE9C497341E77DD885CB9A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050747E0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 129COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?loadFromData@QImage@@QAE_NPBEHPBD@Z.QT5GUI(?,?,?), ref: 0507485D
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(?), ref: 0507487E
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(00000000), ref: 0507488B
                                                                                                                                                                                                                        • ?loadFromData@QImage@@QAE_NABVQByteArray@@PBD@Z.QT5GUI(?,?), ref: 05074914
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(?), ref: 05074951
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(00000000), ref: 0507495E
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • BJ1|AA, xrefs: 050748DB
                                                                                                                                                                                                                        • QImage, xrefs: 0507497B
                                                                                                                                                                                                                        • Bk|AA, xrefs: 05074820
                                                                                                                                                                                                                        • loadFromData, xrefs: 05074976
                                                                                                                                                                                                                        • loadFromData(self, data: Optional[PyQt5.sip.array[bytes]], format: Optional[str] = None) -> boolloadFromData(self, data: Union[QByteArray, bytes, bytearray], format: Optional[str] = None) -> bool, xrefs: 05074971
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: From$?loadBool_Data@DeallocImage@@Long$Array@@Byte
                                                                                                                                                                                                                        • String ID: BJ1|AA$Bk|AA$QImage$loadFromData$loadFromData(self, data: Optional[PyQt5.sip.array[bytes]], format: Optional[str] = None) -> boolloadFromData(self, data: Union[QByteArray, bytes, bytearray], format: Optional[str] = None) -> bool
                                                                                                                                                                                                                        • API String ID: 2669331566-886477975
                                                                                                                                                                                                                        • Opcode ID: 340cca51ed372e5810acf709934d3fa5c807e0ac7a1c81e9b6d1b47ff5233bdf
                                                                                                                                                                                                                        • Instruction ID: c467519c7afc153d67c36141a92811b786d96cc5986870a5ccda960e6bbaa414
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 340cca51ed372e5810acf709934d3fa5c807e0ac7a1c81e9b6d1b47ff5233bdf
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3A41FEB1108306AFDB01DF50DC45E6FBBE9FB84314F104929F895C22A0DB76E95ADB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050DA660 Relevance: 18.3, APIs: 12, Instructions: 286COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyErr_Clear.PYTHON3 ref: 050DA66B
                                                                                                                                                                                                                        • PyLong_AsVoidPtr.PYTHON3(?), ref: 050DA671
                                                                                                                                                                                                                        • PyErr_Occurred.PYTHON3 ref: 050DA67C
                                                                                                                                                                                                                        • PyErr_Clear.PYTHON3 ref: 050DA68E
                                                                                                                                                                                                                        • ?rehash@QHashData@@QAEXH@Z.QT5CORE(?,?,?), ref: 050DA723
                                                                                                                                                                                                                        • ?allocateNode@QHashData@@QAEPAXH@Z.QT5CORE(00000004,?,?), ref: 050DA740
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Err_$ClearData@@Hash$?allocate?rehash@Long_Node@OccurredVoid
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 336667604-0
                                                                                                                                                                                                                        • Opcode ID: 934922b2c92279ce159c0abbb133a77d99077f9ee972a71cd673d6a4bc118de3
                                                                                                                                                                                                                        • Instruction ID: a3baaaef9e880f77bfecdf0b2a0aa172cf675d1f181a209954d7647df34c003d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 934922b2c92279ce159c0abbb133a77d99077f9ee972a71cd673d6a4bc118de3
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 04B149B57043059FCB04DF24E89896EFBE6FF88760B058569E9458B350DB34ED06CBA1
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00402370 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 145COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                                                                                                                                                                        • String ID: P%
                                                                                                                                                                                                                        • API String ID: 2147705588-2959514604
                                                                                                                                                                                                                        • Opcode ID: 4779583b6165d53cbf8f2ebd436e25e3f78b969fa8961c87bf186bca652e6f9b
                                                                                                                                                                                                                        • Instruction ID: ab84631f0651d0ee5a96381c4044ee0ed1be7ca295fb525e9842aa76770568ef
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4779583b6165d53cbf8f2ebd436e25e3f78b969fa8961c87bf186bca652e6f9b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: FE51F8B19083108FC714EF29D58826ABBF0BF88711F45897EFC898B356E7788544DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FFA480 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 136COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?insertRow@QStandardItemModel@@QAEXHABV?$QList@PAVQStandardItem@@@@@Z.QT5GUI(?,?), ref: 04FFA4F2
                                                                                                                                                                                                                        • ?insertRow@QStandardItemModel@@QAEXHPAVQStandardItem@@@Z.QT5GUI(?,?), ref: 04FFA565
                                                                                                                                                                                                                        • ?insertRow@QStandardItemModel@@QAE_NHABVQModelIndex@@@Z.QT5GUI(?,?), ref: 04FFA603
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 04FFA60D
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Bi|J9, xrefs: 04FFA5D0
                                                                                                                                                                                                                        • QStandardItemModel, xrefs: 04FFA62B
                                                                                                                                                                                                                        • insertRow, xrefs: 04FFA626
                                                                                                                                                                                                                        • BiJ3, xrefs: 04FFA4C2
                                                                                                                                                                                                                        • BiJ:, xrefs: 04FFA535
                                                                                                                                                                                                                        • insertRow(self, row: int, items: Iterable[QStandardItem])insertRow(self, arow: int, aitem: Optional[QStandardItem])insertRow(self, row: int, parent: QModelIndex = QModelIndex()) -> bool, xrefs: 04FFA621
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Standard$?insertItemModel@@Row@$Bool_FromIndex@@@Item@@@Item@@@@@List@LongModel
                                                                                                                                                                                                                        • String ID: BiJ3$BiJ:$Bi|J9$QStandardItemModel$insertRow$insertRow(self, row: int, items: Iterable[QStandardItem])insertRow(self, arow: int, aitem: Optional[QStandardItem])insertRow(self, row: int, parent: QModelIndex = QModelIndex()) -> bool
                                                                                                                                                                                                                        • API String ID: 2192900846-2847055373
                                                                                                                                                                                                                        • Opcode ID: d36d530dbe96e53cee48718ea7fd99833db27d6064e4fe0f10aeecc0aa964b74
                                                                                                                                                                                                                        • Instruction ID: 16a70e483774b9780289890fb9563a0584f5ab9934f648da9f7dbbcf50287a6a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d36d530dbe96e53cee48718ea7fd99833db27d6064e4fe0f10aeecc0aa964b74
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: EF516E75108305AFD710CF54DC85EABBBE9FB88314F040929F994D22A0D775E99ACB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040D980 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 129fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Address %p has no image-section, xrefs: 0040DB2B
                                                                                                                                                                                                                        • Mingw-w64 runtime failure:, xrefs: 0040D9A8
                                                                                                                                                                                                                        • VirtualProtect failed with code 0x%x, xrefs: 0040DAE6
                                                                                                                                                                                                                        • VirtualQuery failed for %d bytes at address %p, xrefs: 0040DB17
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: QueryVirtualabortfwritevfprintf
                                                                                                                                                                                                                        • String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
                                                                                                                                                                                                                        • API String ID: 2513968241-1534286854
                                                                                                                                                                                                                        • Opcode ID: 69dd2dc4324f01b3bcb49cc819a7a143dff0d4cc5149ad4f68664ebf5ddb0b11
                                                                                                                                                                                                                        • Instruction ID: 12c366034f147c51322be65863a430c13289ac5cb36f6d5ee6a9828dd919d681
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 69dd2dc4324f01b3bcb49cc819a7a143dff0d4cc5149ad4f68664ebf5ddb0b11
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C7514EB19083018FC710EF69D88565BFBF0FF84354F45896EE88997255E738E844CB9A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05058470 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyFloat_FromDouble.PYTHON3 ref: 050584BD
                                                                                                                                                                                                                        • PyFloat_FromDouble.PYTHON3 ref: 050584CE
                                                                                                                                                                                                                        • PyFloat_FromDouble.PYTHON3 ref: 050584DF
                                                                                                                                                                                                                        • PyFloat_FromDouble.PYTHON3 ref: 050584F4
                                                                                                                                                                                                                        • PyUnicode_FromFormat.PYTHON3(PyQt5.QtGui.QQuaternion(%R, %R, %R, %R),00000000,00000000,00000000,00000000), ref: 05058514
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(00000000), ref: 0505853B
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(00000000), ref: 0505855D
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(00000000), ref: 05058577
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(00000000), ref: 05058591
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • PyQt5.QtGui.QQuaternion(%R, %R, %R, %R), xrefs: 0505850F
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: From$DeallocDoubleFloat_$FormatUnicode_
                                                                                                                                                                                                                        • String ID: PyQt5.QtGui.QQuaternion(%R, %R, %R, %R)
                                                                                                                                                                                                                        • API String ID: 3465742751-829378254
                                                                                                                                                                                                                        • Opcode ID: 7c91aedc985b7b27a142ed2b9f7c8f7413bee2f021fdc9c00fba4f42a4042141
                                                                                                                                                                                                                        • Instruction ID: cbe0ae3c6dca44406f12c0ee1ca710e3694dd60a9aec0349ce627d06c0fbf042
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7c91aedc985b7b27a142ed2b9f7c8f7413bee2f021fdc9c00fba4f42a4042141
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6E3109319147054BC750DF38AC61A2F7BE5BF4A270F748725FC6697290FB30A9998B81
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004061B0 Relevance: 16.6, APIs: 10, Strings: 1, Instructions: 143stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Cannot allocate memory for necessary files., xrefs: 0040639F
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: memcpystrncpy$malloc$callocfreestrlenstrncat
                                                                                                                                                                                                                        • String ID: Cannot allocate memory for necessary files.
                                                                                                                                                                                                                        • API String ID: 1441568290-2795144771
                                                                                                                                                                                                                        • Opcode ID: 911552b35a245790c964822b8ef5d942a4fe4b7b21c60f757b82a0e17b75a1fd
                                                                                                                                                                                                                        • Instruction ID: 3dc4d87da5770e9ddebe32c392722ba7e048c8290a166a4e568edb3e8c8cc1ad
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 911552b35a245790c964822b8ef5d942a4fe4b7b21c60f757b82a0e17b75a1fd
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F35105B16093018FC714EF65C08469ABBE4FF88314F12892EE9C997351E778E588CB86
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00406410 Relevance: 16.6, APIs: 9, Strings: 2, Instructions: 140stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • SPLASH: Cannot extract requirement %s., xrefs: 00406629
                                                                                                                                                                                                                        • SPLASH: Cannot find requirement %s in archive., xrefs: 0040653D
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: strlenstrncpy$callocfreememcpystrcmp
                                                                                                                                                                                                                        • String ID: SPLASH: Cannot extract requirement %s.$SPLASH: Cannot find requirement %s in archive.
                                                                                                                                                                                                                        • API String ID: 1148940474-4094522769
                                                                                                                                                                                                                        • Opcode ID: 6f7344fd9e2b8a238fed55bc04f9f176e9703f704dcf6b52d8a3a35027e7dce5
                                                                                                                                                                                                                        • Instruction ID: eeb11d6563064941a90a30efff23fdfd712fb47c201b2447917d1c532d445a23
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6f7344fd9e2b8a238fed55bc04f9f176e9703f704dcf6b52d8a3a35027e7dce5
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8B51E4B05097059FC324EF25D58529FFBE0BF84744F02882EEAC997352D7789884DB96
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050405A0 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 138COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?addEllipse@QPainterPath@@QAEXABVQRectF@@@Z.QT5GUI(?), ref: 050405F6
                                                                                                                                                                                                                        • ?addEllipse@QPainterPath@@QAEXABVQRectF@@@Z.QT5GUI(?), ref: 0504067C
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • addEllipse, xrefs: 0504076C
                                                                                                                                                                                                                        • Bdddd, xrefs: 05040624
                                                                                                                                                                                                                        • addEllipse(self, rect: QRectF)addEllipse(self, x: float, y: float, w: float, h: float)addEllipse(self, center: Union[QPointF, QPoint], rx: float, ry: float), xrefs: 05040767
                                                                                                                                                                                                                        • BJ9, xrefs: 050405CF
                                                                                                                                                                                                                        • QPainterPath, xrefs: 05040771
                                                                                                                                                                                                                        • BJ1dd, xrefs: 050406B8
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?addEllipse@F@@@PainterPath@@Rect
                                                                                                                                                                                                                        • String ID: BJ1dd$BJ9$Bdddd$QPainterPath$addEllipse$addEllipse(self, rect: QRectF)addEllipse(self, x: float, y: float, w: float, h: float)addEllipse(self, center: Union[QPointF, QPoint], rx: float, ry: float)
                                                                                                                                                                                                                        • API String ID: 253817928-3440497614
                                                                                                                                                                                                                        • Opcode ID: 6adbf4d4b9f5029c16115c86e6e88e0c39dc36d626517050c4db9308fbfd73aa
                                                                                                                                                                                                                        • Instruction ID: 76b95bbf0ec3ee664e16084c525a23cd30186cc20248c242ed28e0b755e237bf
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6adbf4d4b9f5029c16115c86e6e88e0c39dc36d626517050c4db9308fbfd73aa
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: AB517B71518709AFC702CF64D881DABBBEDFF89254F004A1AF949A6110EB70EA858B52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004086F0 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • FormatMessageW.KERNEL32(?,?,?,?,00402FD9), ref: 0040873F
                                                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32 ref: 00408787
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00402FD9), ref: 004087D0
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • PyInstaller: FormatMessageW failed., xrefs: 004087C2
                                                                                                                                                                                                                        • Failed to encode wchar_t as UTF-8., xrefs: 004087E0
                                                                                                                                                                                                                        • PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 004087FA
                                                                                                                                                                                                                        • FormatMessageW, xrefs: 004087B0
                                                                                                                                                                                                                        • No error messages generated., xrefs: 004087A8
                                                                                                                                                                                                                        • WideCharToMultiByte, xrefs: 004087E8
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ByteCharErrorFormatLastMessageMultiWide
                                                                                                                                                                                                                        • String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
                                                                                                                                                                                                                        • API String ID: 1653872744-2573406579
                                                                                                                                                                                                                        • Opcode ID: f18fbf8d48d34d915993c9fedb6177582b1632770400b321313a73d9a670d996
                                                                                                                                                                                                                        • Instruction ID: e5d7e6b934a0c345d3486c1070e2a035779d45014a63eb974780677ace9c2cb0
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f18fbf8d48d34d915993c9fedb6177582b1632770400b321313a73d9a670d996
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8B111AB45093018BE310AF69D54835BBAF0EB94389F50892EE4D49A285D7BD858C8BA7
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00407FD0 Relevance: 15.1, APIs: 10, Instructions: 77fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 004046B0: _wfopen.MSVCRT ref: 00404703
                                                                                                                                                                                                                          • Part of subcall function 00407DD0: strlen.MSVCRT ref: 00407E4A
                                                                                                                                                                                                                          • Part of subcall function 00407DD0: strtok.MSVCRT ref: 00407E5C
                                                                                                                                                                                                                          • Part of subcall function 00407DD0: strlen.MSVCRT ref: 00407E7B
                                                                                                                                                                                                                          • Part of subcall function 00407DD0: strlen.MSVCRT ref: 00407E8F
                                                                                                                                                                                                                          • Part of subcall function 00407DD0: strcpy.MSVCRT(?,?,00000000), ref: 00407EA3
                                                                                                                                                                                                                          • Part of subcall function 00407DD0: strtok.MSVCRT ref: 00407EB7
                                                                                                                                                                                                                          • Part of subcall function 00407DD0: _wstat.MSVCRT ref: 00407EE1
                                                                                                                                                                                                                        • feof.MSVCRT ref: 00408033
                                                                                                                                                                                                                        • fread.MSVCRT ref: 00408057
                                                                                                                                                                                                                        • ferror.MSVCRT ref: 00408063
                                                                                                                                                                                                                        • clearerr.MSVCRT ref: 00408074
                                                                                                                                                                                                                        • fwrite.MSVCRT ref: 00408093
                                                                                                                                                                                                                        • ferror.MSVCRT ref: 0040809F
                                                                                                                                                                                                                        • clearerr.MSVCRT ref: 004080B0
                                                                                                                                                                                                                        • fclose.MSVCRT ref: 004080B8
                                                                                                                                                                                                                        • fclose.MSVCRT ref: 004080C0
                                                                                                                                                                                                                        • fclose.MSVCRT ref: 004080E3
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: fclosestrlen$clearerrferrorstrtok$_wfopen_wstatfeoffreadfwritestrcpy
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3104166669-0
                                                                                                                                                                                                                        • Opcode ID: 8e6a509980fd6fa00181d3b83e4a0fbf1b4b6af25df58c2b9d8ba5ed948ad107
                                                                                                                                                                                                                        • Instruction ID: e6213c5d7688b8fe1ba8341ac8fdb9db29b335e178dc78efa11f235658ae9a09
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8e6a509980fd6fa00181d3b83e4a0fbf1b4b6af25df58c2b9d8ba5ed948ad107
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6C2110716087518AD7107F2696812AFB6E4AF84354F07493FE8D4A73C1DB7DC889CB8A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00411E60 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 127COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: %*.*s$%-*.*s$%.*s
                                                                                                                                                                                                                        • API String ID: 0-4054516066
                                                                                                                                                                                                                        • Opcode ID: f3ac9e74d6ea6427b37e06dd8f71590da5508e7645840674976c8b3a356ca51e
                                                                                                                                                                                                                        • Instruction ID: 34a7cfded508d75713a3901c6ba7bdf4e42489cc40e2d4f26330675e440d4311
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f3ac9e74d6ea6427b37e06dd8f71590da5508e7645840674976c8b3a356ca51e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D74140B16047018BDB148F28C5C5696B7E1BF84354F25866EEE898F36AD339D8C2CB49
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05052520 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 124COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?drawStaticText@QPainter@@QAEXABVQPointF@@ABVQStaticText@@@Z.QT5GUI(?,?), ref: 0505258E
                                                                                                                                                                                                                        • ?drawStaticText@QPainter@@QAEXABVQPointF@@ABVQStaticText@@@Z.QT5GUI(?,?), ref: 0505268B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • drawStaticText(self, topLeftPosition: Union[QPointF, QPoint], staticText: QStaticText)drawStaticText(self, p: QPoint, staticText: QStaticText)drawStaticText(self, x: int, y: int, staticText: QStaticText), xrefs: 050526B2
                                                                                                                                                                                                                        • BJ9J9, xrefs: 050525DA
                                                                                                                                                                                                                        • drawStaticText, xrefs: 050526B7
                                                                                                                                                                                                                        • BJ1J9, xrefs: 05052563
                                                                                                                                                                                                                        • BiiJ9, xrefs: 0505263F
                                                                                                                                                                                                                        • QPainter, xrefs: 050526BC
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Static$?drawPainter@@PointText@Text@@@
                                                                                                                                                                                                                        • String ID: BJ1J9$BJ9J9$BiiJ9$QPainter$drawStaticText$drawStaticText(self, topLeftPosition: Union[QPointF, QPoint], staticText: QStaticText)drawStaticText(self, p: QPoint, staticText: QStaticText)drawStaticText(self, x: int, y: int, staticText: QStaticText)
                                                                                                                                                                                                                        • API String ID: 2951735819-1355667304
                                                                                                                                                                                                                        • Opcode ID: 8c415c2f5620d18cf435b77bd95838ff4101b8892eedb9cb2451e341fa206f2c
                                                                                                                                                                                                                        • Instruction ID: ea730220560b61406b7ebdf71b5a4f78d54ca252271ab648dbb81cbfd9aa3293
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8c415c2f5620d18cf435b77bd95838ff4101b8892eedb9cb2451e341fa206f2c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 94413975118306AFD701CF94D881DABBBF9FF88310F044929F95593260EB71E99ACB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050425B0 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 124COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?drawPicture@QPainter@@QAEXABVQPointF@@ABVQPicture@@@Z.QT5GUI(?,?), ref: 0504261E
                                                                                                                                                                                                                        • ?drawPicture@QPainter@@QAEXABVQPointF@@ABVQPicture@@@Z.QT5GUI(?,?), ref: 0504271B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • BJ9J9, xrefs: 050426CE
                                                                                                                                                                                                                        • drawPicture, xrefs: 05042747
                                                                                                                                                                                                                        • BJ1J9, xrefs: 050425F3
                                                                                                                                                                                                                        • BiiJ9, xrefs: 05042669
                                                                                                                                                                                                                        • drawPicture(self, p: Union[QPointF, QPoint], picture: QPicture)drawPicture(self, x: int, y: int, p: QPicture)drawPicture(self, pt: QPoint, p: QPicture), xrefs: 05042742
                                                                                                                                                                                                                        • QPainter, xrefs: 0504274C
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?drawPainter@@Picture@Picture@@@Point
                                                                                                                                                                                                                        • String ID: BJ1J9$BJ9J9$BiiJ9$QPainter$drawPicture$drawPicture(self, p: Union[QPointF, QPoint], picture: QPicture)drawPicture(self, x: int, y: int, p: QPicture)drawPicture(self, pt: QPoint, p: QPicture)
                                                                                                                                                                                                                        • API String ID: 4028054459-2799232556
                                                                                                                                                                                                                        • Opcode ID: 35e166cc6f0190984427b2fc61842eac5e937659286ed1d3c612cccc7c8d767a
                                                                                                                                                                                                                        • Instruction ID: 675cf4e7bdc195439972ae19eaf9732da273add4ec83f9974271d7e444e90907
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 35e166cc6f0190984427b2fc61842eac5e937659286ed1d3c612cccc7c8d767a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 03413875128206AFD701CF94D881DABBBE9FF88354F04492AF954D3160E771E98ACB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05092490 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 112COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?ortho@QMatrix4x4@@QAEXABVQRect@@@Z.QT5GUI(?), ref: 050924E2
                                                                                                                                                                                                                        • ?ortho@QMatrix4x4@@QAEXABVQRectF@@@Z.QT5GUI(?), ref: 0509252F
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • ortho(self, rect: QRect)ortho(self, rect: QRectF)ortho(self, left: float, right: float, bottom: float, top: float, nearPlane: float, farPlane: float), xrefs: 050925FC
                                                                                                                                                                                                                        • QMatrix4x4, xrefs: 05092606
                                                                                                                                                                                                                        • ortho, xrefs: 05092601
                                                                                                                                                                                                                        • Bffffff, xrefs: 05092568
                                                                                                                                                                                                                        • BJ9, xrefs: 050924BB, 05092508
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?ortho@Matrix4x4@@$F@@@RectRect@@@
                                                                                                                                                                                                                        • String ID: BJ9$Bffffff$QMatrix4x4$ortho$ortho(self, rect: QRect)ortho(self, rect: QRectF)ortho(self, left: float, right: float, bottom: float, top: float, nearPlane: float, farPlane: float)
                                                                                                                                                                                                                        • API String ID: 2089082609-2834352261
                                                                                                                                                                                                                        • Opcode ID: e220eb4fff59bc51402e64742be3e389368a33717a5012b8204d31b8cfb857f2
                                                                                                                                                                                                                        • Instruction ID: c09a8e4d0fc52ee5aea3468722e134af4f3dc45097ae7afcd3c5645c61c9e218
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e220eb4fff59bc51402e64742be3e389368a33717a5012b8204d31b8cfb857f2
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F2416C31118306BFD701CF55D881DAFBBE9FB88310F448A19F999921A0EB30E999DF52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05036770 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 111COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?translate@QPainter@@QAEXABVQPointF@@@Z.QT5GUI(?), ref: 050367CF
                                                                                                                                                                                                                        • ?translate@QPainter@@QAEXABVQPointF@@@Z.QT5GUI(?), ref: 050368AA
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • translate, xrefs: 050368D6
                                                                                                                                                                                                                        • BJ1, xrefs: 050367A8
                                                                                                                                                                                                                        • translate(self, offset: Union[QPointF, QPoint])translate(self, dx: float, dy: float)translate(self, offset: QPoint), xrefs: 050368D1
                                                                                                                                                                                                                        • BJ9, xrefs: 05036861
                                                                                                                                                                                                                        • QPainter, xrefs: 050368DB
                                                                                                                                                                                                                        • Bdd, xrefs: 0503680F
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?translate@F@@@Painter@@Point
                                                                                                                                                                                                                        • String ID: BJ1$BJ9$Bdd$QPainter$translate$translate(self, offset: Union[QPointF, QPoint])translate(self, dx: float, dy: float)translate(self, offset: QPoint)
                                                                                                                                                                                                                        • API String ID: 1352926342-1057202190
                                                                                                                                                                                                                        • Opcode ID: c9cd6f73251f2e70e25a85a85f4e594793d85ab2f00b5549508ce1e7fd4a31b6
                                                                                                                                                                                                                        • Instruction ID: 9becb463862804dd6f4228ba15df7fef5e502748fc0851f8aa992c855d1556d6
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c9cd6f73251f2e70e25a85a85f4e594793d85ab2f00b5549508ce1e7fd4a31b6
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BE412C71118306AFD701CF94DC81DAABBEDFF88350F044919F94593260EB71E98ACB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0502E4F0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 80COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?supportsCharacter@QRawFont@@QBE_NI@Z.QT5GUI(?), ref: 0502E539
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 0502E543
                                                                                                                                                                                                                        • ?supportsCharacter@QRawFont@@QBE_NVQChar@@@Z.QT5GUI(?), ref: 0502E5A7
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(00000000), ref: 0502E5CC
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • BJ1, xrefs: 0502E578
                                                                                                                                                                                                                        • supportsCharacter(self, ucs4: int) -> boolsupportsCharacter(self, character: str) -> bool, xrefs: 0502E5DF
                                                                                                                                                                                                                        • supportsCharacter, xrefs: 0502E5E4
                                                                                                                                                                                                                        • QRawFont, xrefs: 0502E5E9
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?supportsBool_Character@Font@@FromLong$Char@@@
                                                                                                                                                                                                                        • String ID: BJ1$QRawFont$supportsCharacter$supportsCharacter(self, ucs4: int) -> boolsupportsCharacter(self, character: str) -> bool
                                                                                                                                                                                                                        • API String ID: 158530332-3516427216
                                                                                                                                                                                                                        • Opcode ID: 82510407988ff9fb184ddc2045547be20a3620756c8edc6a219211d49d99918f
                                                                                                                                                                                                                        • Instruction ID: 44b098c4c3e62d37322007a68fd7b71afc35641b8d54da0ffe2e807184f0bdcc
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 82510407988ff9fb184ddc2045547be20a3620756c8edc6a219211d49d99918f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0D31B170158205BFDB01DB94DC45DBA7BE9FB88300F444859F988C3261DB79E999DB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050424C0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 68COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?intersects@QPainterPath@@QBE_NABVQRectF@@@Z.QT5GUI(?), ref: 0504250F
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 05042519
                                                                                                                                                                                                                        • ?intersects@QPainterPath@@QBE_NABV1@@Z.QT5GUI(?), ref: 05042566
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 05042570
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?intersects@Bool_FromLongPainterPath@@$F@@@RectV1@@
                                                                                                                                                                                                                        • String ID: BJ9$QPainterPath$intersects$intersects(self, rect: QRectF) -> boolintersects(self, p: QPainterPath) -> bool
                                                                                                                                                                                                                        • API String ID: 2587214874-2232891685
                                                                                                                                                                                                                        • Opcode ID: eece2adb61a9d521cdb417d666927bceed581642744532c2040dd88033adc3c7
                                                                                                                                                                                                                        • Instruction ID: ad42b8b393e4a55fcaf43e9c5bab85476c3f2319d57e9afa696872798aa0a769
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: eece2adb61a9d521cdb417d666927bceed581642744532c2040dd88033adc3c7
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4C2183B4144206AFDB01DF94EC46D7A7BE9FB88204F444469F958C2250DB74EA59DB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0501C4F0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 68COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?intersects@QRegion@@QBE_NABV1@@Z.QT5GUI(?), ref: 0501C53A
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 0501C544
                                                                                                                                                                                                                        • ?intersects@QRegion@@QBE_NABVQRect@@@Z.QT5GUI(?), ref: 0501C596
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 0501C5A0
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?intersects@Bool_FromLongRegion@@$Rect@@@V1@@
                                                                                                                                                                                                                        • String ID: BJ9$QRegion$intersects$intersects(self, r: QRegion) -> boolintersects(self, r: QRect) -> bool
                                                                                                                                                                                                                        • API String ID: 1491266576-3209683298
                                                                                                                                                                                                                        • Opcode ID: 7c99e78b6881a45d35c40baf16adea64b485907fd8440cccaa61fbca62c5f0a4
                                                                                                                                                                                                                        • Instruction ID: 81a242c3fd3f74516ba551494be3b14fb597f5c21378e47fb51b3593ed555361
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7c99e78b6881a45d35c40baf16adea64b485907fd8440cccaa61fbca62c5f0a4
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B1215375114206BFDB01DB94EC46D7E7BE9FB88200F444429FD58C2250DB79EA59DB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00408810 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 66COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00408CF4), ref: 0040885C
                                                                                                                                                                                                                        • calloc.MSVCRT ref: 00408875
                                                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32 ref: 004088B7
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ByteCharMultiWide$calloc
                                                                                                                                                                                                                        • String ID: Failed to encode filename as ANSI.$Failed to get ANSI buffer size.$Out of memory.$WideCharToMultiByte$win32_wcs_to_mbs
                                                                                                                                                                                                                        • API String ID: 1374691127-3831141058
                                                                                                                                                                                                                        • Opcode ID: c3fa3e70c31a3458ec14f411ced81c1205de6429d75ae9f1c074563e70b42a84
                                                                                                                                                                                                                        • Instruction ID: 5afcbffd29298bee6e331de86764b825c866944575c44242363fe351b07975aa
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c3fa3e70c31a3458ec14f411ced81c1205de6429d75ae9f1c074563e70b42a84
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8521F5B15093059FD310AF66D64835BBBE4EB90358F00892EE4D85B281DBB984889BDB
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00408920 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 64COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000), ref: 00408970
                                                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000), ref: 004089D1
                                                                                                                                                                                                                        • calloc.MSVCRT ref: 004089EA
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ByteCharMultiWide$calloc
                                                                                                                                                                                                                        • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                                                                                                                        • API String ID: 1374691127-27947307
                                                                                                                                                                                                                        • Opcode ID: 2b09dc83ad61f560e2c3f0a7be34deb6504115085fa0c16350d3644281db57d5
                                                                                                                                                                                                                        • Instruction ID: 392d32d0dc93c970adbdd4bd206061dd84090e66cdb548403919dc1ed5805d2f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2b09dc83ad61f560e2c3f0a7be34deb6504115085fa0c16350d3644281db57d5
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B021E7B01093028BD310AF66D55831BBAE4EF94758F00892EE4E4572D0D7B9D989DB97
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00408374 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 61stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • LOADER: failed to strdup argv[%d]: %s, xrefs: 0040840A
                                                                                                                                                                                                                        • LOADER: failed to allocate argv_pyi: %s, xrefs: 0040842D
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: _errnostrerror$_strdupcalloc
                                                                                                                                                                                                                        • String ID: LOADER: failed to allocate argv_pyi: %s$LOADER: failed to strdup argv[%d]: %s
                                                                                                                                                                                                                        • API String ID: 4278403329-2782260415
                                                                                                                                                                                                                        • Opcode ID: 888027ff366d88e196ffac7e22f8e9512d8f32fb5de0ea3c8c6ec2f618f8796d
                                                                                                                                                                                                                        • Instruction ID: 75a4103835d43aa6c95cb7ec3b6db505b02a0d5b0f758bc2d410c1ae15a23f9c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 888027ff366d88e196ffac7e22f8e9512d8f32fb5de0ea3c8c6ec2f618f8796d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0A2179B4904711CFC720AF75D94419ABBE0EB45314F514A7EE894A33A1E739E881CB9A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004014F0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 43libraryloaderCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AddressProc$HandleLibraryLoadModule
                                                                                                                                                                                                                        • String ID: , B$__deregister_frame_info$__register_frame_info$libgcc_s_dw2-1.dll
                                                                                                                                                                                                                        • API String ID: 384173800-2541462354
                                                                                                                                                                                                                        • Opcode ID: a376881f7d4377a9ad5e0e3f6ac5215553b1e171285a39ee36456c721ec719f3
                                                                                                                                                                                                                        • Instruction ID: 6c6c026f4a83c0f72c7764c329cd2c4586c53e905c616f5fc2452e48b3062107
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a376881f7d4377a9ad5e0e3f6ac5215553b1e171285a39ee36456c721ec719f3
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 200175B1805304ABD700BF79AD4425ABFF4EB44399F02853FE98957260D7789848CB9F
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050D8460 Relevance: 13.6, APIs: 9, Instructions: 115COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(00000001,00000000,00000000,00000000,6CD36110,050DAC79,00000000), ref: 050D8486
                                                                                                                                                                                                                        • PyObject_SetAttrString.PYTHON3(?,05143D10,00000000), ref: 050D84A4
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(00000000), ref: 050D84C1
                                                                                                                                                                                                                        • PyLong_FromUnsignedLong.PYTHON3(FFFFFFFF,00000000,00000000,00000000,6CD36110,050DAC79,00000000), ref: 050D84F6
                                                                                                                                                                                                                        • PyObject_SetAttrString.PYTHON3(?,05143CCC,00000000), ref: 050D8514
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(00000000), ref: 050D8531
                                                                                                                                                                                                                        • PyLong_FromUnsignedLongLong.PYTHON3(FFFFFFFF,FFFFFFFF,00000000,00000000,00000000,6CD36110,050DAC79,00000000), ref: 050D856C
                                                                                                                                                                                                                        • PyObject_SetAttrString.PYTHON3(?,05143CE0,00000000), ref: 050D8586
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(00000000), ref: 050D85A3
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Long$AttrDeallocFromLong_Object_String$Unsigned
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3558067623-0
                                                                                                                                                                                                                        • Opcode ID: d7c39106cab431a9141e991f32961dad5f82ec452e1dba301090c971c5a9eb79
                                                                                                                                                                                                                        • Instruction ID: 66475d38a88516f5975a54d0ae7b660dc24444dd42ec464c3b05df658742dd9f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d7c39106cab431a9141e991f32961dad5f82ec452e1dba301090c971c5a9eb79
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: EE41C3364013109BC7224B54BC5567AFBE5FF403B1F28873CE926522A4EB312A669B91
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004055C3 Relevance: 13.5, APIs: 9, Instructions: 49COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: setbuf$_fileno_setmodefflush
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1650367497-0
                                                                                                                                                                                                                        • Opcode ID: 7a9e4e7938dbc5579c4c6519335179e61544e4fd34365661340af95d00fc0a84
                                                                                                                                                                                                                        • Instruction ID: 4513b405083115c81ca635af3cf8f4969db3efee2aa6dccd88a9e4f4ed2810d7
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7a9e4e7938dbc5579c4c6519335179e61544e4fd34365661340af95d00fc0a84
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CB1120B15097108BD7007FB5D59936EBBE0BF45314F83481DD4C897241EBBD94848B9A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05082560 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 244COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ??0QColorSpace@@QAE@W4NamedColorSpace@0@@Z.QT5GUI(?), ref: 050825E9
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Color$NamedSpace@0@@Space@@malloc
                                                                                                                                                                                                                        • String ID: EE|f$J1J1J1J1E|f
                                                                                                                                                                                                                        • API String ID: 3101405599-2715126939
                                                                                                                                                                                                                        • Opcode ID: 64a935cde17eede40d3db6bbce656c9b63a12d756554ccbb03dbc8c43ad04c27
                                                                                                                                                                                                                        • Instruction ID: 532471b934c18f3cd853fc9cd345942cddcee144f0aed8a85a32b3a53ac8eca2
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 64a935cde17eede40d3db6bbce656c9b63a12d756554ccbb03dbc8c43ad04c27
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5781E572214300BFE7409B95EC85EAFBBE9FB88710F440429FA4582190DB76A995CB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050564A0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 183COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ??0QStandardItem@@QAE@XZ.QT5GUI ref: 050564E4
                                                                                                                                                                                                                        • ??0QStandardItem@@QAE@ABVQString@@@Z.QT5GUI(?), ref: 05056556
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Item@@Standard$String@@@malloc
                                                                                                                                                                                                                        • String ID: J9J1$i|i
                                                                                                                                                                                                                        • API String ID: 975822958-229932593
                                                                                                                                                                                                                        • Opcode ID: 77914ceefdcfc95b5ae4d5fae5d892b07ad4880b314c4b36216361616151387d
                                                                                                                                                                                                                        • Instruction ID: 76ad6b1bb4bcad5e2e991fcbc91d6329c9029003fd5e3efe12d5452bdaa23042
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 77914ceefdcfc95b5ae4d5fae5d892b07ad4880b314c4b36216361616151387d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 78519171244301AFD760CFA5EC45F9BBBE9EB88750F040429FA49C7250DB75E948DBA2
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0509C5C0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 141COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?boundingRect@QFontMetricsF@@QBE?AVQRectF@@ABVQString@@@Z.QT5GUI(00000000,?), ref: 0509C634
                                                                                                                                                                                                                        • ?boundingRect@QFontMetricsF@@QBE?AVQRectF@@ABV2@HABVQString@@HPAH@Z.QT5GUI(00000000,?,?,?,?,00000000), ref: 0509C71B
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • boundingRect(self, string: Optional[str]) -> QRectFboundingRect(self, rect: QRectF, flags: int, text: Optional[str], tabStops: int = 0, tabArray: Optional[List[int]] = None) -> QRectF, xrefs: 0509C769
                                                                                                                                                                                                                        • BJ9iJ1|iN, xrefs: 0509C6C9
                                                                                                                                                                                                                        • BJ1, xrefs: 0509C5FD
                                                                                                                                                                                                                        • QFontMetricsF, xrefs: 0509C773
                                                                                                                                                                                                                        • boundingRect, xrefs: 0509C76E
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?boundingFontMetricsRectRect@$String@@String@@@malloc
                                                                                                                                                                                                                        • String ID: BJ1$BJ9iJ1|iN$QFontMetricsF$boundingRect$boundingRect(self, string: Optional[str]) -> QRectFboundingRect(self, rect: QRectF, flags: int, text: Optional[str], tabStops: int = 0, tabArray: Optional[List[int]] = None) -> QRectF
                                                                                                                                                                                                                        • API String ID: 3847197108-2500380854
                                                                                                                                                                                                                        • Opcode ID: 7ac34dc7c292598baea15f81e3a62adc317aad5b30cb2ec1d8f4c15626c8b1a9
                                                                                                                                                                                                                        • Instruction ID: 30b24be7ee075eb91eb786fbe49dd894684eca03c2c6a0ac4143c74b36098b4b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7ac34dc7c292598baea15f81e3a62adc317aad5b30cb2ec1d8f4c15626c8b1a9
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7A518075114301AFEB11DF94EC41FABBBE9FB88714F040819FA4493260D735EA99DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05074660 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 123COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?copy@QPixmap@@QBE?AV1@ABVQRect@@@Z.QT5GUI(00000000,?), ref: 050746E0
                                                                                                                                                                                                                        • ?copy@QPixmap@@QBE?AV1@ABVQRect@@@Z.QT5GUI(00000000,?), ref: 0507478C
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • B|J9, xrefs: 0507469F
                                                                                                                                                                                                                        • copy(self, rect: QRect = QRect()) -> QPixmapcopy(self, ax: int, ay: int, awidth: int, aheight: int) -> QPixmap, xrefs: 050747B9
                                                                                                                                                                                                                        • Biiii, xrefs: 0507472C
                                                                                                                                                                                                                        • QPixmap, xrefs: 050747C3
                                                                                                                                                                                                                        • copy, xrefs: 050747BE
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?copy@Pixmap@@Rect@@@$malloc
                                                                                                                                                                                                                        • String ID: Biiii$B|J9$QPixmap$copy$copy(self, rect: QRect = QRect()) -> QPixmapcopy(self, ax: int, ay: int, awidth: int, aheight: int) -> QPixmap
                                                                                                                                                                                                                        • API String ID: 3508988656-3263214344
                                                                                                                                                                                                                        • Opcode ID: 384c96edecf29ac3430975585a90ff959b8fef03ff3ce7cce3e19908c60f4a5e
                                                                                                                                                                                                                        • Instruction ID: d210eff0d2a2a8a0a01f2e34efbc511e15241eb0cce339c36e36a40cde014588
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 384c96edecf29ac3430975585a90ff959b8fef03ff3ce7cce3e19908c60f4a5e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 68416E75518201AFD710DF54DC81E9BBBE8FBC8710F044929F984D3290E774EA8ACB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05072560 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 122COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?scaled@QImage@@QBE?AV1@ABVQSize@@W4AspectRatioMode@Qt@@W4TransformationMode@4@@Z.QT5GUI(00000000,?,?,?), ref: 05072608
                                                                                                                                                                                                                        • ?scaled@QImage@@QBE?AV1@ABVQSize@@W4AspectRatioMode@Qt@@W4TransformationMode@4@@Z.QT5GUI(00000000,?,?,?), ref: 050726B7
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • scaled, xrefs: 050726E8
                                                                                                                                                                                                                        • BJ9|EE, xrefs: 05072670
                                                                                                                                                                                                                        • scaled(self, width: int, height: int, aspectRatioMode: Qt.AspectRatioMode = Qt.IgnoreAspectRatio, transformMode: Qt.TransformationMode = Qt.FastTransformation) -> QImagescaled(self, size: QSize, aspectRatioMode: Qt.AspectRatioMode = Qt.IgnoreAspectRatio, tran, xrefs: 050726E3
                                                                                                                                                                                                                        • Bii|EE, xrefs: 050725B0
                                                                                                                                                                                                                        • QImage, xrefs: 050726ED
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?scaled@AspectImage@@Mode@Mode@4@@Qt@@RatioSize@@Transformation$malloc
                                                                                                                                                                                                                        • String ID: BJ9|EE$Bii|EE$QImage$scaled$scaled(self, width: int, height: int, aspectRatioMode: Qt.AspectRatioMode = Qt.IgnoreAspectRatio, transformMode: Qt.TransformationMode = Qt.FastTransformation) -> QImagescaled(self, size: QSize, aspectRatioMode: Qt.AspectRatioMode = Qt.IgnoreAspectRatio, tran
                                                                                                                                                                                                                        • API String ID: 790955744-2329271099
                                                                                                                                                                                                                        • Opcode ID: e5a1b499146e35396868e1431c42d0a4f7a3e181da1fe6733cb22af63159fa27
                                                                                                                                                                                                                        • Instruction ID: 5b265b23543d3305611692d3a230806ff5ba93601746a9d1c6b7a40eb168451d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e5a1b499146e35396868e1431c42d0a4f7a3e181da1fe6733cb22af63159fa27
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: FD418074108306AFEB11CF54DC41FABBBE9FB88304F004819F994922A0D775E999DF92
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0504C450 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 111COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?drawRects@QPainter@@QAEXPBVQRectF@@H@Z.QT5GUI(?,00000001), ref: 0504C4A4
                                                                                                                                                                                                                        • ?drawRects@QPainter@@QAEXPBVQRect@@H@Z.QT5GUI(?,00000001), ref: 0504C569
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?drawPainter@@Rects@$RectRect@@
                                                                                                                                                                                                                        • String ID: BJ9$Biiii$QPainter$drawRect$drawRect(self, rect: QRectF)drawRect(self, x: int, y: int, w: int, h: int)drawRect(self, r: QRect)
                                                                                                                                                                                                                        • API String ID: 2285679371-1954626498
                                                                                                                                                                                                                        • Opcode ID: 5b7f64727e3e3ded8c666780cce5e3b9721b7f045f6fe613c003e1d650fb563c
                                                                                                                                                                                                                        • Instruction ID: 8abfe9874ec95525196368169700980ed28120c8e90c1f7b96a5f4b23d71a84b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5b7f64727e3e3ded8c666780cce5e3b9721b7f045f6fe613c003e1d650fb563c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 99413C71208206AFD701CF54DC85DAFBBE9FB88310F444829F959C3260E771E9898B52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0503E440 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?lineTo@QPainterPath@@QAEXABVQPointF@@@Z.QT5GUI(?), ref: 0503E49C
                                                                                                                                                                                                                        • ?lineTo@QPainterPath@@QAEXABVQPointF@@@Z.QT5GUI(?), ref: 0503E51C
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?lineF@@@PainterPath@@Point
                                                                                                                                                                                                                        • String ID: BJ1$Bdd$QPainterPath$lineTo$lineTo(self, p: Union[QPointF, QPoint])lineTo(self, x: float, y: float)
                                                                                                                                                                                                                        • API String ID: 1554915965-2382092456
                                                                                                                                                                                                                        • Opcode ID: 22107ee1cf04fb990ea7adb9cf089dacb6283ac377b54e8805adcf5644437e6d
                                                                                                                                                                                                                        • Instruction ID: 26ac770f38731c370fba44856c1525d3521ae6d2dfa0bb3db696748d6f6d14db
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 22107ee1cf04fb990ea7adb9cf089dacb6283ac377b54e8805adcf5644437e6d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3D318D75108206AFD701CF94DC81D6ABBF9FB8C304F004919F998C3260EB75E98ADB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05088700 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 81COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?uniformLocation@QOpenGLShaderProgram@@QBEHABVQByteArray@@@Z.QT5GUI(?), ref: 0508875F
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(00000000), ref: 05088781
                                                                                                                                                                                                                        • ?uniformLocation@QOpenGLShaderProgram@@QBEHABVQString@@@Z.QT5GUI(?), ref: 050887DE
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • uniformLocation(self, name: Union[QByteArray, bytes, bytearray]) -> intuniformLocation(self, name: Optional[str]) -> int, xrefs: 050887FC
                                                                                                                                                                                                                        • BJ1, xrefs: 05088738, 050887B7
                                                                                                                                                                                                                        • uniformLocation, xrefs: 05088801
                                                                                                                                                                                                                        • QOpenGLShaderProgram, xrefs: 05088806
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?uniformLocation@OpenProgram@@Shader$Array@@@ByteFromLongLong_String@@@
                                                                                                                                                                                                                        • String ID: BJ1$QOpenGLShaderProgram$uniformLocation$uniformLocation(self, name: Union[QByteArray, bytes, bytearray]) -> intuniformLocation(self, name: Optional[str]) -> int
                                                                                                                                                                                                                        • API String ID: 4012138631-58999457
                                                                                                                                                                                                                        • Opcode ID: b66ab5fdbc3d44415510ab964a6355b18a48d7384718c895ba167fc4735472dd
                                                                                                                                                                                                                        • Instruction ID: fb95beb124ffcb835c706e645db63ee0e99736180f6371814ed600d93f00bca9
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b66ab5fdbc3d44415510ab964a6355b18a48d7384718c895ba167fc4735472dd
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C531A475118202AFD701DF54DC85EBBBBEAFF88310F408859F99893260DB71E959DB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0502E7D0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ??0QVariant@@QAE@ABVQString@@@Z.QT5CORE(?), ref: 0502E831
                                                                                                                                                                                                                        • ?setProperty@QTextFormat@@QAEXHABVQVariant@@@Z.QT5GUI(00002031,?), ref: 0502E843
                                                                                                                                                                                                                        • ??1QVariant@@QAE@XZ.QT5CORE ref: 0502E84D
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Variant@@$?setFormat@@Property@String@@@TextVariant@@@
                                                                                                                                                                                                                        • String ID: BJ1$QTextCharFormat$setAnchorHref$setAnchorHref(self, value: Optional[str])
                                                                                                                                                                                                                        • API String ID: 3611022156-778645884
                                                                                                                                                                                                                        • Opcode ID: 8058f744856d8f57686ad45c1a2796d0de4f598bd7bd6c999f2a15e1a100be1b
                                                                                                                                                                                                                        • Instruction ID: 73b0e2c47ea06d2c700db3d92deb94b905f2ae56632a15423295c41fdf4acc20
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8058f744856d8f57686ad45c1a2796d0de4f598bd7bd6c999f2a15e1a100be1b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 60214170114202AFD701DF94DC85EAA7FE9FB88714F044418F989D3260DB75A99ADB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05018510 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 62threadCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyEval_SaveThread.PYTHON3 ref: 0501854E
                                                                                                                                                                                                                        • ?sender@QObject@@IBEPAV1@XZ.QT5CORE ref: 0501855A
                                                                                                                                                                                                                        • PyEval_RestoreThread.PYTHON3(00000000), ref: 05018563
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Eval_Thread$?sender@Object@@RestoreSave
                                                                                                                                                                                                                        • String ID: QSyntaxHighlighter$qtcore_qobject_sender$sender$sender(self) -> Optional[QObject]
                                                                                                                                                                                                                        • API String ID: 10903585-3811315525
                                                                                                                                                                                                                        • Opcode ID: 11932106b1a7a92ea1b6fc6f734de1e98bc77bfb9bec04030f0d56dd9e195ace
                                                                                                                                                                                                                        • Instruction ID: 8f7f4b4f7670b2b8fd2289f5340b5197fa539f0dae762e9d202f9d6c0eb97e7b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 11932106b1a7a92ea1b6fc6f734de1e98bc77bfb9bec04030f0d56dd9e195ace
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BC11B130654201AFDB01EFA4ED46E6A3BE5FB88611F044434FA08C7251EB78ED89CB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FE8410 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 62threadCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyEval_SaveThread.PYTHON3 ref: 04FE844E
                                                                                                                                                                                                                        • ?sender@QObject@@IBEPAV1@XZ.QT5CORE ref: 04FE845A
                                                                                                                                                                                                                        • PyEval_RestoreThread.PYTHON3(00000000), ref: 04FE8463
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Eval_Thread$?sender@Object@@RestoreSave
                                                                                                                                                                                                                        • String ID: QTextDocument$qtcore_qobject_sender$sender$sender(self) -> Optional[QObject]
                                                                                                                                                                                                                        • API String ID: 10903585-1049448907
                                                                                                                                                                                                                        • Opcode ID: a9ce0bba618c297a2d226029bf13db924d89e975ee66c0c1ea6209132d653e85
                                                                                                                                                                                                                        • Instruction ID: 4d77ac5a2ecf1f83cc3cefd783c48f178d3467d18f964fffe309bd1ba79cf568
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a9ce0bba618c297a2d226029bf13db924d89e975ee66c0c1ea6209132d653e85
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4C119071654201AFDB11EFA8ED46E6A3BE5FB88711F040424F908C7251EB78ED9ACB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05088470 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 62threadCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyEval_SaveThread.PYTHON3 ref: 050884AE
                                                                                                                                                                                                                        • ?sender@QObject@@IBEPAV1@XZ.QT5CORE ref: 050884BA
                                                                                                                                                                                                                        • PyEval_RestoreThread.PYTHON3(00000000), ref: 050884C3
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Eval_Thread$?sender@Object@@RestoreSave
                                                                                                                                                                                                                        • String ID: QOpenGLWindow$qtcore_qobject_sender$sender$sender(self) -> Optional[QObject]
                                                                                                                                                                                                                        • API String ID: 10903585-409682347
                                                                                                                                                                                                                        • Opcode ID: 87a4e37913a0ebd28edad5231d2f6f783728b48a8ee975808151aeee959d850f
                                                                                                                                                                                                                        • Instruction ID: 81f6cb9093e040b53affa9355ca90299d47e4b5c41e0959cd0168c87a8714fc2
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 87a4e37913a0ebd28edad5231d2f6f783728b48a8ee975808151aeee959d850f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0311B135654201AFDB01EBA8ED46EAA3BE5FB84610F484424F948D7350EB78ED89CB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FE4570 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 62threadCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyEval_SaveThread.PYTHON3 ref: 04FE45AE
                                                                                                                                                                                                                        • ?sender@QObject@@IBEPAV1@XZ.QT5CORE ref: 04FE45BA
                                                                                                                                                                                                                        • PyEval_RestoreThread.PYTHON3(00000000), ref: 04FE45C3
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Eval_Thread$?sender@Object@@RestoreSave
                                                                                                                                                                                                                        • String ID: QTextBlockGroup$qtcore_qobject_sender$sender$sender(self) -> Optional[QObject]
                                                                                                                                                                                                                        • API String ID: 10903585-813202499
                                                                                                                                                                                                                        • Opcode ID: 496c40793aadcfc1efcfa5b767c1344896c52ae5b2b7b9a4dd2c33f8a5450ebb
                                                                                                                                                                                                                        • Instruction ID: 642ec04a17ff6370756197734db30e59e445f72254c0e4a7b161f744cf093b3c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 496c40793aadcfc1efcfa5b767c1344896c52ae5b2b7b9a4dd2c33f8a5450ebb
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: EB11D030654201AFDB01EFA8ED46EAA3BE4FB84611F044034F908C7350EB78ED8ADB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FEC470 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 61COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?count@?$QVector@VQPoint@@@@QBEHABVQPoint@@@Z.QT5CORE(?), ref: 04FEC4BF
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(00000000), ref: 04FEC4C6
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(?), ref: 04FEC50E
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: FromLongLong_$?count@?$Point@@@Point@@@@Vector@
                                                                                                                                                                                                                        • String ID: BJ9$QPolygon$count$count(self, value: QPoint) -> intcount(self) -> int
                                                                                                                                                                                                                        • API String ID: 2804007485-2639480543
                                                                                                                                                                                                                        • Opcode ID: b6b00a4d62b9411cb0bb6ec9677ca3fc68fb709fdbc83ae9267709835c84b486
                                                                                                                                                                                                                        • Instruction ID: ff19ddf7a130d183b106091864ae777851dfb36a3f7abc8bc851f8657ad2538d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b6b00a4d62b9411cb0bb6ec9677ca3fc68fb709fdbc83ae9267709835c84b486
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5721A2B4104206BFDB01DFA4EC46E6A7BE9FF88700F444464F948C3260E775EA5ADB42
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040DE30 Relevance: 12.1, APIs: 8, Instructions: 90COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: signal
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1946981877-0
                                                                                                                                                                                                                        • Opcode ID: 2b651e1b467f7154d26db624bfdf5758aeaee69f22ed160fdee85f15cbcdd14c
                                                                                                                                                                                                                        • Instruction ID: 529314676596798a44e2e7d48aea7ed491276213eefa766ee39382917f2d3c55
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2b651e1b467f7154d26db624bfdf5758aeaee69f22ed160fdee85f15cbcdd14c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: DD3103B09056018AD7206FB8C84432F76D0AF55728F128A2FE4E5DB3D1DB7DD888979B
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00407BC0 Relevance: 12.1, APIs: 8, Instructions: 68COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                                                                                                                                                                                                        • wcscpy.MSVCRT ref: 00407C07
                                                                                                                                                                                                                        • wcslen.MSVCRT ref: 00407C0F
                                                                                                                                                                                                                        • wcscat.MSVCRT ref: 00407C39
                                                                                                                                                                                                                        • _wfindfirst.MSVCRT ref: 00407C4C
                                                                                                                                                                                                                        • _wrmdir.MSVCRT ref: 00407C68
                                                                                                                                                                                                                        • wcscat.MSVCRT ref: 00407CDE
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: wcscat$ByteCharMultiWide_wfindfirst_wrmdirwcscpywcslen
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 955055573-0
                                                                                                                                                                                                                        • Opcode ID: 802cfa8735c993ec09b655bbe795d2bd26a3e6085fba014a598c9f678fc7b595
                                                                                                                                                                                                                        • Instruction ID: 812287d127834224555eaebaea1a5f31319f6ec07a572a1decaabcd838263556
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 802cfa8735c993ec09b655bbe795d2bd26a3e6085fba014a598c9f678fc7b595
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 572117B490D3049BD720AF75D88869EBBE4FB84304F118C3EE9C993251E7389585DB9B
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00408B00 Relevance: 12.1, APIs: 3, Strings: 5, Instructions: 60COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B91
                                                                                                                                                                                                                        • calloc.MSVCRT ref: 00408BAA
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ByteCharMultiWide$calloc
                                                                                                                                                                                                                        • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                                                                                                                                                                        • API String ID: 1374691127-876015163
                                                                                                                                                                                                                        • Opcode ID: d6a78e633d9bb543a46de6eff9a097cd2261dbab8d0e33fc600cb80726c8ebad
                                                                                                                                                                                                                        • Instruction ID: 686223d8df53a97fa17e1b733178636a5c74384edd7780f85d5042dc75bc6c3c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d6a78e633d9bb543a46de6eff9a097cd2261dbab8d0e33fc600cb80726c8ebad
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: AD2118B05083059FD310AF65C64925ABBF4EB84754F04893EE5E8572C1DBB8D8449B9B
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004124D0 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 406COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: fputwc$memset
                                                                                                                                                                                                                        • String ID: 0$o
                                                                                                                                                                                                                        • API String ID: 822753988-4157579757
                                                                                                                                                                                                                        • Opcode ID: c0d80a03fa09052c1a669441533165b430e64d4749c6fff7dd3072524ed2086e
                                                                                                                                                                                                                        • Instruction ID: b65a98287eddb54592c783ac7525ef4ab93ad80493cd3b98cbaa9a691208da40
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c0d80a03fa09052c1a669441533165b430e64d4749c6fff7dd3072524ed2086e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 79F16F71E102198FDB14CF68C6942DEBBF1BF44310F15822AE865EB385D778E892CB94
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040F730 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 404COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: fputc$memset
                                                                                                                                                                                                                        • String ID: 0$o
                                                                                                                                                                                                                        • API String ID: 2944404495-4157579757
                                                                                                                                                                                                                        • Opcode ID: 62ce1c91e6c4f14205547f0573e4b3f914893ff815fa095c8c03e974051d489c
                                                                                                                                                                                                                        • Instruction ID: 9062061d76251826460344fe4ffb90a7e4f33a362718e540e131347e649c7f22
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 62ce1c91e6c4f14205547f0573e4b3f914893ff815fa095c8c03e974051d489c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2BF14D72E002199FDB24DF68D49069EBBB1BF84310F15817AE859BB785D338E946CF84
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00406A75 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 138COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: free
                                                                                                                                                                                                                        • String ID: _image_data$exit$rename ::source ::_source$source$tclInit$tcl_findLibrary
                                                                                                                                                                                                                        • API String ID: 1294909896-1126984729
                                                                                                                                                                                                                        • Opcode ID: b3db61e08089af8a0f48b7dd3434c65c66f42e085b044ee94ceec25c32d68ff5
                                                                                                                                                                                                                        • Instruction ID: 5837fc7092d7bfd19bff1a36fcf45920a7a04ffe6dc7564dff579a9c2d03099d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b3db61e08089af8a0f48b7dd3434c65c66f42e085b044ee94ceec25c32d68ff5
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3A61F9B8609301CFD710AF64D48821ABBF0FF49344F81897DE9859B350D7B99859CF2A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050487D0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 116COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?addRoundedRect@QPainterPath@@QAEXABVQRectF@@NNW4SizeMode@Qt@@@Z.QT5GUI(?), ref: 05048935
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Bdddddd|E, xrefs: 050488AD
                                                                                                                                                                                                                        • addRoundedRect, xrefs: 05048960
                                                                                                                                                                                                                        • BJ9dd|E, xrefs: 0504881B
                                                                                                                                                                                                                        • addRoundedRect(self, rect: QRectF, xRadius: float, yRadius: float, mode: Qt.SizeMode = Qt.AbsoluteSize)addRoundedRect(self, x: float, y: float, w: float, h: float, xRadius: float, yRadius: float, mode: Qt.SizeMode = Qt.AbsoluteSize), xrefs: 0504895B
                                                                                                                                                                                                                        • QPainterPath, xrefs: 05048965
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?addMode@PainterPath@@Qt@@@RectRect@RoundedSize
                                                                                                                                                                                                                        • String ID: BJ9dd|E$Bdddddd|E$QPainterPath$addRoundedRect$addRoundedRect(self, rect: QRectF, xRadius: float, yRadius: float, mode: Qt.SizeMode = Qt.AbsoluteSize)addRoundedRect(self, x: float, y: float, w: float, h: float, xRadius: float, yRadius: float, mode: Qt.SizeMode = Qt.AbsoluteSize)
                                                                                                                                                                                                                        • API String ID: 3899202734-3066850139
                                                                                                                                                                                                                        • Opcode ID: 392a96ca5e153b5d54ebc65b9a6818a1521326c331bf079227b222cf2da7f7ca
                                                                                                                                                                                                                        • Instruction ID: e6e6e35e771d0ba17bb27e7e29f14f3dc0a56fe726e6c43a5fb605750a3ff5a3
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 392a96ca5e153b5d54ebc65b9a6818a1521326c331bf079227b222cf2da7f7ca
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 96416C71108B09AFC702CFA4DD41EAFB7F9FF89704F008A1AF99896150EBB1D9459B42
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00411A40 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 111COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: %-*.*S$%.*S
                                                                                                                                                                                                                        • API String ID: 0-812388239
                                                                                                                                                                                                                        • Opcode ID: d3ea50cc3d132d3143849def37d31036af112e818d385dd3d02cc72e2dcc9aec
                                                                                                                                                                                                                        • Instruction ID: c23151172c0a1ec719629ee0893607804d1b15add0b79fb5692203c1bf32c755
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d3ea50cc3d132d3143849def37d31036af112e818d385dd3d02cc72e2dcc9aec
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7D4196B1A097159BC7109F29D4812DEBBE0AF84794F14C52FE5488B361E33DD9C1CB8A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05024560 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyType_IsSubtype.PYTHON3(?,057FD408), ref: 05024578
                                                                                                                                                                                                                        • ??XQVector4D@@QAEAAV0@M@Z.QT5GUI ref: 050245E7
                                                                                                                                                                                                                        • ??XQVector4D@@QAEAAV0@ABV0@@Z.QT5GUI(?), ref: 05024632
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(?), ref: 05024664
                                                                                                                                                                                                                        • PyErr_Clear.PYTHON3 ref: 05024679
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Vector4$ClearDeallocErr_SubtypeType_V0@@
                                                                                                                                                                                                                        • String ID: 1J9
                                                                                                                                                                                                                        • API String ID: 3048805026-2407233842
                                                                                                                                                                                                                        • Opcode ID: 5bfccabefdf6c795610ebde4995cf5b24de9ab1258259a2f35f08b7f89a9cee4
                                                                                                                                                                                                                        • Instruction ID: dd945942b5e4ff113246a5980991fedd2fb1de8b1b585a35f15b16e574f25d27
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5bfccabefdf6c795610ebde4995cf5b24de9ab1258259a2f35f08b7f89a9cee4
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6C31C6712142019FCB54CF5CE84996EBBE5FF88321F24452DF95AC32A0DB70E856CB51
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050006C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyType_IsSubtype.PYTHON3(?,057F7DB8), ref: 050006DA
                                                                                                                                                                                                                        • ??XQTransform@@QAEAAV0@ABV0@@Z.QT5GUI(?), ref: 05000747
                                                                                                                                                                                                                        • ??XQTransform@@QAEAAV0@N@Z.QT5GUI ref: 05000798
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(?), ref: 050007CC
                                                                                                                                                                                                                        • PyErr_Clear.PYTHON3 ref: 050007E1
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Transform@@$ClearDeallocErr_SubtypeType_V0@@
                                                                                                                                                                                                                        • String ID: 1J9
                                                                                                                                                                                                                        • API String ID: 1803680539-2407233842
                                                                                                                                                                                                                        • Opcode ID: 0785ef32a12efd390726e285b5f3fa6f59e2feeacf53f3b86b9e16236336e10d
                                                                                                                                                                                                                        • Instruction ID: 6a2df373bccf5873a348ddb85da041652e61fda6698c933e933f3f0f150d341e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0785ef32a12efd390726e285b5f3fa6f59e2feeacf53f3b86b9e16236336e10d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C531E3312042018FD740CF6CF999A7E7BE5BF88221F540529F89AD32A0EB34E84ACB51
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050585B0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 96COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?fromHtml@QTextDocumentFragment@@SA?AV1@ABVQString@@@Z.QT5GUI(00000000,?,00000004), ref: 05058603
                                                                                                                                                                                                                        • ?fromHtml@QTextDocumentFragment@@SA?AV1@ABVQString@@PBVQTextDocument@@@Z.QT5GUI(00000000,?,?,00000004), ref: 05058691
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • fromHtml(html: Optional[str]) -> QTextDocumentFragmentfromHtml(html: Optional[str], resourceProvider: Optional[QTextDocument]) -> QTextDocumentFragment, xrefs: 050586D2
                                                                                                                                                                                                                        • J1J8, xrefs: 05058666
                                                                                                                                                                                                                        • QTextDocumentFragment, xrefs: 050586DC
                                                                                                                                                                                                                        • fromHtml, xrefs: 050586D7
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Text$?fromDocumentFragment@@Html@$Document@@@String@@String@@@malloc
                                                                                                                                                                                                                        • String ID: J1J8$QTextDocumentFragment$fromHtml$fromHtml(html: Optional[str]) -> QTextDocumentFragmentfromHtml(html: Optional[str], resourceProvider: Optional[QTextDocument]) -> QTextDocumentFragment
                                                                                                                                                                                                                        • API String ID: 954486155-1997975570
                                                                                                                                                                                                                        • Opcode ID: 659d04fc37b01ec67825d1ce5fda652747c845fecb34cf6bb89e336ed62fdb2f
                                                                                                                                                                                                                        • Instruction ID: 352dcc17e0a6d7f49307c4fd3c816a85662ab636e709cac82dca77d784d8ff1f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 659d04fc37b01ec67825d1ce5fda652747c845fecb34cf6bb89e336ed62fdb2f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D0317471154302AFEB01DF94DC46EAB7BE9FB48300F044858FE44972A0DB75AD99DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FF87C0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 81COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?mapRect@QTransform@@QBE?AVQRect@@ABV2@@Z.QT5GUI(00000000,?), ref: 04FF881A
                                                                                                                                                                                                                        • ?mapRect@QTransform@@QBE?AVQRectF@@ABV2@@Z.QT5GUI(00000000,?), ref: 04FF888A
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?mapRect@Transform@@V2@@$RectRect@@malloc
                                                                                                                                                                                                                        • String ID: BJ9$QTransform$mapRect$mapRect(self, a0: QRect) -> QRectmapRect(self, a0: QRectF) -> QRectF
                                                                                                                                                                                                                        • API String ID: 2145820410-2123702598
                                                                                                                                                                                                                        • Opcode ID: 23185daba044655da4a55a02927dc05a04db7a6c1b09a9870f10dca8f99627ae
                                                                                                                                                                                                                        • Instruction ID: 7e8b652b0f6c8c8ed62f3fdbc40572145e323fccebd2fcf9ca4921716a157c77
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 23185daba044655da4a55a02927dc05a04db7a6c1b09a9870f10dca8f99627ae
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4021A571514202AFEB01DBA4EC42FBA7BE9BB48304F444464FA48C3260D775EA99DB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05052410 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 76COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?fromEulerAngles@QQuaternion@@SA?AV1@MMM@Z.QT5GUI(00000000), ref: 05052478
                                                                                                                                                                                                                        • ?fromEulerAngles@QQuaternion@@SA?AV1@ABVQVector3D@@@Z.QT5GUI(00000000,?,00000010), ref: 050524D1
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • fromEulerAngles(pitch: float, yaw: float, roll: float) -> QQuaternionfromEulerAngles(eulerAngles: QVector3D) -> QQuaternion, xrefs: 050524F6
                                                                                                                                                                                                                        • fff, xrefs: 05052429
                                                                                                                                                                                                                        • fromEulerAngles, xrefs: 050524FB
                                                                                                                                                                                                                        • QQuaternion, xrefs: 05052500
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?fromAngles@EulerQuaternion@@$D@@@Vector3malloc
                                                                                                                                                                                                                        • String ID: QQuaternion$fff$fromEulerAngles$fromEulerAngles(pitch: float, yaw: float, roll: float) -> QQuaternionfromEulerAngles(eulerAngles: QVector3D) -> QQuaternion
                                                                                                                                                                                                                        • API String ID: 588884526-1175617480
                                                                                                                                                                                                                        • Opcode ID: 73b50bf10e6d3c71710602187fafeb0d1ef5a5e6175d19358529eaaf124d6375
                                                                                                                                                                                                                        • Instruction ID: 325e22ea45911d3175b1c1453b6d1b4448274b6fe513b3793e9bcabcfe476b98
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 73b50bf10e6d3c71710602187fafeb0d1ef5a5e6175d19358529eaaf124d6375
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D521E431554301AFE701EFA8DC42E9AB7E8FF88300F444854F948D32A1E775E9D89B12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0501A4D0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 74COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?united@QRegion@@QBE?AV1@ABV1@@Z.QT5GUI(00000000,?), ref: 0501A525
                                                                                                                                                                                                                        • ?united@QRegion@@QBE?AV1@ABVQRect@@@Z.QT5GUI(00000000,?), ref: 0501A595
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?united@Region@@$Rect@@@V1@@malloc
                                                                                                                                                                                                                        • String ID: BJ9$QRegion$united$united(self, r: QRegion) -> QRegionunited(self, r: QRect) -> QRegion
                                                                                                                                                                                                                        • API String ID: 2920062276-2430780886
                                                                                                                                                                                                                        • Opcode ID: 04fa8eed51d3e1aa6a12a354400e7905a3ac479ba0c3fd07fde7340b38ff4e78
                                                                                                                                                                                                                        • Instruction ID: 52fe46c5d3df9173801fc6bc2a7aa2df261de4c4be894af3eb1271403c7f49c4
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 04fa8eed51d3e1aa6a12a354400e7905a3ac479ba0c3fd07fde7340b38ff4e78
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8C218671218202BFE711DB94EC42FAA7BEDFB88304F444424FA5CC3250E675EA99CB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040E9C1 Relevance: 10.6, APIs: 7, Instructions: 71COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: freembstowcssetlocalewcstombs$realloc
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2323685431-0
                                                                                                                                                                                                                        • Opcode ID: 45279616c9b6d3ccdbfd2aaa52830abb573ecc6ee843925474a723046d140ec2
                                                                                                                                                                                                                        • Instruction ID: 0ece9848e1b9cb63aa0c7ac93180fa40d32587a4740361e1b5221defc5654884
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 45279616c9b6d3ccdbfd2aaa52830abb573ecc6ee843925474a723046d140ec2
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BA3129B09083159ECB10AF66C1452AEFBF0FF48344F51882FE888A7350E7789995CB86
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05008560 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 65COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?createList@QTextCursor@@QAEPAVQTextList@@ABVQTextListFormat@@@Z.QT5GUI(?), ref: 050085AF
                                                                                                                                                                                                                        • ?createList@QTextCursor@@QAEPAVQTextList@@W4Style@QTextListFormat@@@Z.QT5GUI(?), ref: 05008614
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • createList, xrefs: 05008626
                                                                                                                                                                                                                        • createList(self, format: QTextListFormat) -> Optional[QTextList]createList(self, style: QTextListFormat.Style) -> Optional[QTextList], xrefs: 05008621
                                                                                                                                                                                                                        • QTextCursor, xrefs: 0500862B
                                                                                                                                                                                                                        • BJ9, xrefs: 05008585
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Text$?createCursor@@Format@@@ListList@List@@$Style@
                                                                                                                                                                                                                        • String ID: BJ9$QTextCursor$createList$createList(self, format: QTextListFormat) -> Optional[QTextList]createList(self, style: QTextListFormat.Style) -> Optional[QTextList]
                                                                                                                                                                                                                        • API String ID: 1378842967-1943373005
                                                                                                                                                                                                                        • Opcode ID: 82d54863b2fa1fdfa287bf9a1d25d6e57773432ed700af185c6f571ab8a5e6ac
                                                                                                                                                                                                                        • Instruction ID: 3a323ba91931e2708e782416e5ddb7fd4b99aa11d2df96a9012017fec12deb7e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 82d54863b2fa1fdfa287bf9a1d25d6e57773432ed700af185c6f571ab8a5e6ac
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 47214170114206AFEB01DB94DC42EBE7BE9FB88300F048424F958D32A0DB75EE99DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0506E7B0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 65COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?metric@QPaintDevice@@MBEHW4PaintDeviceMetric@1@@Z.QT5GUI(?), ref: 0506E828
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(00000000), ref: 0506E82F
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(00000000), ref: 0506E843
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • metric(self, metric: QPaintDevice.PaintDeviceMetric) -> int, xrefs: 0506E856
                                                                                                                                                                                                                        • metric, xrefs: 0506E85B
                                                                                                                                                                                                                        • QPagedPaintDevice, xrefs: 0506E860
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: FromLongLong_Paint$?metric@DeviceDevice@@Metric@1@@
                                                                                                                                                                                                                        • String ID: QPagedPaintDevice$metric$metric(self, metric: QPaintDevice.PaintDeviceMetric) -> int
                                                                                                                                                                                                                        • API String ID: 71264651-1160872689
                                                                                                                                                                                                                        • Opcode ID: ebe08f81c9b3204ca17e5812e5ffc137b845e315addef4714bd1f824f82177ed
                                                                                                                                                                                                                        • Instruction ID: c9231b4ddea6d1abd15626d2b2d9f29ac92cc7f3979fbaf2a2732f667b6e72ef
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ebe08f81c9b3204ca17e5812e5ffc137b845e315addef4714bd1f824f82177ed
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8F11B174144202AFD700DBA4ED86EAB7BE9FF44610F484424FD08D7220EA79E998DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05010640 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 65COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?metric@QPicture@@MBEHW4PaintDeviceMetric@QPaintDevice@@@Z.QT5GUI(?), ref: 050106B8
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(00000000), ref: 050106BF
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(00000000), ref: 050106D3
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: FromLongLong_Paint$?metric@DeviceDevice@@@Metric@Picture@@
                                                                                                                                                                                                                        • String ID: QPicture$metric$metric(self, m: QPaintDevice.PaintDeviceMetric) -> int
                                                                                                                                                                                                                        • API String ID: 16325608-1761873249
                                                                                                                                                                                                                        • Opcode ID: 25c21bc6265a119c6823736cc1cd204308acb4a7b82ea991b2aabde9f43ca19b
                                                                                                                                                                                                                        • Instruction ID: 93f384b6f2b71d1fa34f315e6155d6d7d0c0fed7e69ad4bea562511233371353
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 25c21bc6265a119c6823736cc1cd204308acb4a7b82ea991b2aabde9f43ca19b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5511D674554202AFD740DBA4EC4AEAE3BE8FB84710F484424FC48C7221E67AE998DB53
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00403446 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 58stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: strcmp
                                                                                                                                                                                                                        • String ID: %s%c%s%c%s%c%s$%s%c%s.pkg$Failed to extract %s$\$\$\
                                                                                                                                                                                                                        • API String ID: 1004003707-2076181140
                                                                                                                                                                                                                        • Opcode ID: d8422f4b8ab908e08704c80b1f056dfc79cd756015d3aaecdf5715272ff86ff7
                                                                                                                                                                                                                        • Instruction ID: 73055d119674c1d8bf47e55e1769eeb00a0baa58503b6758db3226280ebf56de
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d8422f4b8ab908e08704c80b1f056dfc79cd756015d3aaecdf5715272ff86ff7
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 602128B1508701ABD7109F25C54414AFBE8BF80719F418D2EE5A8A7390D378EA45CF8A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00407CF0 Relevance: 10.6, APIs: 7, Instructions: 58COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: wcscmp$wcscat
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 545343207-0
                                                                                                                                                                                                                        • Opcode ID: ae46feb38f9d982e05331aa8471f37b1e1520206203c39296f539e6903441e66
                                                                                                                                                                                                                        • Instruction ID: 66d593373b9ba32e9ef8b9ba0102b03e4299b10aa04248f83024a0eb22297dfe
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ae46feb38f9d982e05331aa8471f37b1e1520206203c39296f539e6903441e66
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B5113DB140C7458AD710BF2599842AFBAE4AF50344F02583EE9C597245EB7CA4868B9B
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0500E470 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 55COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ??0QVariant@@QAE@N@Z.QT5CORE ref: 0500E4C8
                                                                                                                                                                                                                        • ?setProperty@QTextFormat@@QAEXHABVQVariant@@@Z.QT5GUI(00004102,?), ref: 0500E4DA
                                                                                                                                                                                                                        • ??1QVariant@@QAE@XZ.QT5CORE ref: 0500E4E4
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Variant@@$?setFormat@@Property@TextVariant@@@
                                                                                                                                                                                                                        • String ID: QTextTableFormat$setCellSpacing$setCellSpacing(self, spacing: float)
                                                                                                                                                                                                                        • API String ID: 3865857979-1114204075
                                                                                                                                                                                                                        • Opcode ID: 21c137e2ead12787591817a6e4e7e5782a9ad727b4f9425a6d7ad6f326e2e128
                                                                                                                                                                                                                        • Instruction ID: 56a38e4ac0759e8ac51a388c71fe083deb8471d436e41e3b277349eb91911bca
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 21c137e2ead12787591817a6e4e7e5782a9ad727b4f9425a6d7ad6f326e2e128
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C4119330214206AFD700DFA4D986DAEBBE8FB88310F404859F859D7290EB74998ACB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FEC550 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 55COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?cursorToX@QTextLine@@QBENPAHW4Edge@1@@Z.QT5GUI(?), ref: 04FEC5BB
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Bi|E, xrefs: 04FEC582
                                                                                                                                                                                                                        • cursorToX(self, cursorPos: Optional[int], edge: QTextLine.Edge = QTextLine.Leading) -> (float, Optional[int]), xrefs: 04FEC5F4
                                                                                                                                                                                                                        • cursorToX, xrefs: 04FEC5F9
                                                                                                                                                                                                                        • QTextLine, xrefs: 04FEC5FE
                                                                                                                                                                                                                        • (di), xrefs: 04FEC5DF
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?cursorEdge@1@@Line@@Text
                                                                                                                                                                                                                        • String ID: (di)$Bi|E$QTextLine$cursorToX$cursorToX(self, cursorPos: Optional[int], edge: QTextLine.Edge = QTextLine.Leading) -> (float, Optional[int])
                                                                                                                                                                                                                        • API String ID: 613848636-3366240213
                                                                                                                                                                                                                        • Opcode ID: b70782559ff288d4c99780fa4b58d81bfab6dc3d77981c6cab73974ea02d7d88
                                                                                                                                                                                                                        • Instruction ID: eb47b225ff5c1be9e69e5b30e5c19e3f027ecefeb5aab5585877e0730e7a6c75
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b70782559ff288d4c99780fa4b58d81bfab6dc3d77981c6cab73974ea02d7d88
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BC119074158302AFD701EF94CD42EAABBF8FB84301F404859FA8487260D775E9999B52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05026560 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 53COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ??0QVariant@@QAE@H@Z.QT5CORE(?), ref: 050265AE
                                                                                                                                                                                                                        • ?setProperty@QTextFormat@@QAEXHABVQVariant@@@Z.QT5GUI(00001070,?), ref: 050265C0
                                                                                                                                                                                                                        • ??1QVariant@@QAE@XZ.QT5CORE ref: 050265CA
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Variant@@$?setFormat@@Property@TextVariant@@@
                                                                                                                                                                                                                        • String ID: QTextBlockFormat$setHeadingLevel$setHeadingLevel(self, alevel: int)
                                                                                                                                                                                                                        • API String ID: 3865857979-2168793412
                                                                                                                                                                                                                        • Opcode ID: 2776004cc5cc6a5f78b53ff0c213bf4c89126391a3fd55be741f76bb5629e52b
                                                                                                                                                                                                                        • Instruction ID: 7854d5ee95257b895f2f666c3df113970c85f14fa9eecaa28ddd5d820397db73
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2776004cc5cc6a5f78b53ff0c213bf4c89126391a3fd55be741f76bb5629e52b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5D115430154206AFD701DF64DC46EAE7BE8FB88310F544859F859D32A0DB75E94ACB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0501A410 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 53COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?startSystemResize@QWindow@@QAE_NV?$QFlags@W4Edge@Qt@@@@@Z.QT5GUI(?), ref: 0501A46F
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(00000000), ref: 0501A494
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?startBool_Edge@Flags@FromLongQt@@@@@Resize@SystemWindow@@
                                                                                                                                                                                                                        • String ID: BJ1$QWindow$startSystemResize$startSystemResize(self, edges: Union[Qt.Edges, Qt.Edge]) -> bool
                                                                                                                                                                                                                        • API String ID: 1120000275-297104080
                                                                                                                                                                                                                        • Opcode ID: ca19ad5fbf5774d3ee8b471c05e6ed8eb336279ae21e63dcdde840fe2250c0cc
                                                                                                                                                                                                                        • Instruction ID: 65e36be9fae871fdd64ab7a6938f79152c6b308dbda1f122bc277d4447d5b9a7
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ca19ad5fbf5774d3ee8b471c05e6ed8eb336279ae21e63dcdde840fe2250c0cc
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3011E370158201AFEB01EF54DC46E6A7FE9FB88300F444818F94887261DB36ED99EB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05024480 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 53COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ??0QVariant@@QAE@H@Z.QT5CORE(?), ref: 050244CE
                                                                                                                                                                                                                        • ?setProperty@QTextFormat@@QAEXHABVQVariant@@@Z.QT5GUI(00001040,?), ref: 050244E0
                                                                                                                                                                                                                        • ??1QVariant@@QAE@XZ.QT5CORE ref: 050244EA
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Variant@@$?setFormat@@Property@TextVariant@@@
                                                                                                                                                                                                                        • String ID: QTextBlockFormat$setIndent$setIndent(self, aindent: int)
                                                                                                                                                                                                                        • API String ID: 3865857979-842749707
                                                                                                                                                                                                                        • Opcode ID: 76b7aa9780b5405d0c3f06289d712119a761510d9d3c858e77389ef9329fea14
                                                                                                                                                                                                                        • Instruction ID: c840c66f0a84b8cd32921bcf57a169c0df0fa499fcc1db092222ac2918e3d291
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 76b7aa9780b5405d0c3f06289d712119a761510d9d3c858e77389ef9329fea14
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: FD119434114202AFD701DF64DC46EAE7BE8FB88310F404459F859D72A1EB74994ACB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05034760 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 53COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ??0QVariant@@QAE@_N@Z.QT5CORE(?), ref: 050347AE
                                                                                                                                                                                                                        • ?setProperty@QTextFormat@@QAEXHABVQVariant@@@Z.QT5GUI(00001FE5,?), ref: 050347C0
                                                                                                                                                                                                                        • ??1QVariant@@QAE@XZ.QT5CORE ref: 050347CA
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Variant@@$?setFormat@@Property@TextVariant@@@
                                                                                                                                                                                                                        • String ID: QTextCharFormat$setFontKerning$setFontKerning(self, enable: bool)
                                                                                                                                                                                                                        • API String ID: 3865857979-3926123756
                                                                                                                                                                                                                        • Opcode ID: 5e2f9d7fb390e0b468f030b20e7c037c469dd62601627c12c25d2e18562df099
                                                                                                                                                                                                                        • Instruction ID: 2fc5fb2e77a85d95ba64022805dd7a1d9a165b079e3c3e80df0562a459dad0d8
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5e2f9d7fb390e0b468f030b20e7c037c469dd62601627c12c25d2e18562df099
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4811A335214202AFD700DF64DC46EAE7FE8FB88314F504859F859D72A0EB74E94ACB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05088600 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 52COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?hasExtension@QOpenGLContext@@QBE_NABVQByteArray@@@Z.QT5GUI(?), ref: 0508865D
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(00000000), ref: 05088682
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • hasExtension, xrefs: 0508869A
                                                                                                                                                                                                                        • BJ1, xrefs: 05088632
                                                                                                                                                                                                                        • hasExtension(self, extension: Union[QByteArray, bytes, bytearray]) -> bool, xrefs: 05088695
                                                                                                                                                                                                                        • QOpenGLContext, xrefs: 0508869F
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?hasArray@@@Bool_ByteContext@@Extension@FromLongOpen
                                                                                                                                                                                                                        • String ID: BJ1$QOpenGLContext$hasExtension$hasExtension(self, extension: Union[QByteArray, bytes, bytearray]) -> bool
                                                                                                                                                                                                                        • API String ID: 471544336-2951848314
                                                                                                                                                                                                                        • Opcode ID: 24be766d9bdd8bad420671e11843528bc75243b2500baa1566130e01c8163c63
                                                                                                                                                                                                                        • Instruction ID: b9172491211256f8c132cb557497e4a311d6cbcdb8b9625527a7b1ca33edcc4a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 24be766d9bdd8bad420671e11843528bc75243b2500baa1566130e01c8163c63
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C5119170158201AFDB01EF94DD46E7A7FE9FB88300F404858F94887261DB75E9A9DB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0503A690 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 44COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?distanceToPoint@QVector2D@@QBEMABV1@@Z.QT5GUI(?), ref: 0503A6DA
                                                                                                                                                                                                                        • PyFloat_FromDouble.PYTHON3 ref: 0503A6F5
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?distanceDoubleFloat_FromPoint@V1@@Vector2
                                                                                                                                                                                                                        • String ID: BJ9$QVector2D$distanceToPoint$distanceToPoint(self, point: QVector2D) -> float
                                                                                                                                                                                                                        • API String ID: 3929648902-1918907016
                                                                                                                                                                                                                        • Opcode ID: 20b683ba81ca875e2588dd86893967b0d35767ae8cd9dfbb7406ff8bc9a054ba
                                                                                                                                                                                                                        • Instruction ID: daa03eac6bb00b1eddb8d37517cb3182c59d27bde19b629c941699fa840e9c96
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 20b683ba81ca875e2588dd86893967b0d35767ae8cd9dfbb7406ff8bc9a054ba
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1501D270118201AFD700EB68DC86DAEBBF8FF88300F408959F898D3250E774A9988B42
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05030630 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 41COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?isCopyOf@QTextCursor@@QBE_NABV1@@Z.QT5GUI(?), ref: 0503067A
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 05030684
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Bool_CopyCursor@@FromLongTextV1@@
                                                                                                                                                                                                                        • String ID: BJ9$QPalette$isCopyOf$isCopyOf(self, p: QPalette) -> bool
                                                                                                                                                                                                                        • API String ID: 1629049401-1984342418
                                                                                                                                                                                                                        • Opcode ID: 605c351fb333c2ef032331f9b4cb21adc3217a3ac0b9bb630680e3e5382dcabf
                                                                                                                                                                                                                        • Instruction ID: e2ac5b8da57d2ba056a5199d3de869a2319c694a07a8d4ddae0ea543fbdb52fd
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 605c351fb333c2ef032331f9b4cb21adc3217a3ac0b9bb630680e3e5382dcabf
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2301A774104205AFD701DB94ED46E6E77ECFB84300F444424FD58C7250E778EA59DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0502E460 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 40COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?begin@QPainter@@QAE_NPAVQPaintDevice@@@Z.QT5GUI(?), ref: 0502E4AF
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 0502E4B9
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?begin@Bool_Device@@@FromLongPaintPainter@@
                                                                                                                                                                                                                        • String ID: BJ8$QPainter$begin$begin(self, a0: Optional[QPaintDevice]) -> bool
                                                                                                                                                                                                                        • API String ID: 3984307418-3860318878
                                                                                                                                                                                                                        • Opcode ID: 8a7a80a55b33235dc046bf5ff76db143e29932c8e627a5432c3eb171999c7ee6
                                                                                                                                                                                                                        • Instruction ID: f4ae812df3303ece420c5d5119057b4307b8474f97356f21bfb162ed6be17385
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8a7a80a55b33235dc046bf5ff76db143e29932c8e627a5432c3eb171999c7ee6
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C101A770514205AFDB01DF90ED46E7E7BE8FB44700F444865FD58C2250D779EA99DB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050464B0 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 40COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?isSignalConnected@QObject@@IBE_NABVQMetaMethod@@@Z.QT5CORE(?), ref: 050464FF
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 05046509
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Bool_Connected@FromLongMetaMethod@@@Object@@Signal
                                                                                                                                                                                                                        • String ID: BJ9$QRasterWindow$isSignalConnected$isSignalConnected(self, signal: QMetaMethod) -> bool
                                                                                                                                                                                                                        • API String ID: 544305041-58123335
                                                                                                                                                                                                                        • Opcode ID: 0aeccfff2e3f29bbbdf8301726ac5217ee00356d1a06356dfa3ebd17284a86e4
                                                                                                                                                                                                                        • Instruction ID: 44e33ff7448a8085566c4e01aa14d990e04b67491732b3f7198eeb10599f540e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0aeccfff2e3f29bbbdf8301726ac5217ee00356d1a06356dfa3ebd17284a86e4
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E7018F70614205BFDB01DBA0ED42E7A7BE9FB88700F444824FD58C2250EB79EA599B42
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05084460 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 39COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?areSharing@QOpenGLContext@@SA_NPAV1@0@Z.QT5GUI(?,?), ref: 050844A5
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 050844AF
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • areSharing(first: Optional[QOpenGLContext], second: Optional[QOpenGLContext]) -> bool, xrefs: 050844C1
                                                                                                                                                                                                                        • areSharing, xrefs: 050844C6
                                                                                                                                                                                                                        • J8J8, xrefs: 0508447B
                                                                                                                                                                                                                        • QOpenGLContext, xrefs: 050844CB
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?areBool_Context@@FromLongOpenSharing@V1@0@
                                                                                                                                                                                                                        • String ID: J8J8$QOpenGLContext$areSharing$areSharing(first: Optional[QOpenGLContext], second: Optional[QOpenGLContext]) -> bool
                                                                                                                                                                                                                        • API String ID: 1655846241-2067687427
                                                                                                                                                                                                                        • Opcode ID: 4778eb332a60373db93b33a8a2b98c2ba02a8b8147138ac4603cb82f21a82d15
                                                                                                                                                                                                                        • Instruction ID: 1784c1c4b3f5ba0689b3ff63894e94a521df1614f941cba6d2be356258da59d3
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4778eb332a60373db93b33a8a2b98c2ba02a8b8147138ac4603cb82f21a82d15
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E901D170514201AFCB00EF94EC46E6A7BE8FB84700F444864FD88C2251E7B8DA68AB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FF6660 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 38COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?quadToSquare@QTransform@@SA_NABVQPolygonF@@AAV1@@Z.QT5GUI(?,?), ref: 04FF66AA
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 04FF66B4
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?quadBool_FromLongPolygonSquare@Transform@@V1@@
                                                                                                                                                                                                                        • String ID: J9J9$QTransform$quadToSquare$quadToSquare(quad: QPolygonF, result: QTransform) -> bool
                                                                                                                                                                                                                        • API String ID: 180076461-2972677403
                                                                                                                                                                                                                        • Opcode ID: 8cd495d7295c06531af921002a92a67eec98adab588ecbf988a2a5c883c8ab01
                                                                                                                                                                                                                        • Instruction ID: 1cdf766194216439c9e59e8fd1c97880fb244a5e4ba6d72049ffe64cdae9b865
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8cd495d7295c06531af921002a92a67eec98adab588ecbf988a2a5c883c8ab01
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C401D670154201AFDB01EFA4EC46E6A7BE5BB44700F444864FD48C2120DBB9DA69AB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00417510 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryloaderCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AddressProc$HandleModule
                                                                                                                                                                                                                        • String ID: ___lc_codepage_func$__lc_codepage$msvcrt.dll
                                                                                                                                                                                                                        • API String ID: 667068680-1145701848
                                                                                                                                                                                                                        • Opcode ID: d189fa9efd416f18abebd0a9be443f761bdc61810749ea753c76760930122cfc
                                                                                                                                                                                                                        • Instruction ID: 1b2e568be5773464d0952ec9ee83d8ba760180256f55db537a2820630d2abbb3
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d189fa9efd416f18abebd0a9be443f761bdc61810749ea753c76760930122cfc
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E1F049B0848204ABD700AF38AD4418A7EF0AA08314F15863FC889C7210E778D888CBAA
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040ED40 Relevance: 9.2, APIs: 6, Instructions: 158stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: _stat$freemallocmemcpystrlen
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2821670080-0
                                                                                                                                                                                                                        • Opcode ID: 2e2927e48dad086f7b6652f0e1c13a34fbe12bb134b6987c2c9234558f53e84a
                                                                                                                                                                                                                        • Instruction ID: c5bd95b142fc711015b6ce962a46217c3aa773e4d5f7f4cf9c825846a95b2092
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2e2927e48dad086f7b6652f0e1c13a34fbe12bb134b6987c2c9234558f53e84a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5B5173715093058FC724DF2AC08026BBBE2AF89304F454D6FE8E49B385D339D956DB8A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040FCE0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 307COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: 0
                                                                                                                                                                                                                        • API String ID: 0-4108050209
                                                                                                                                                                                                                        • Opcode ID: 85bd0f672ddd99df0f0a2a81c69a256e0952087e2de33095cd5bd9eaf017051c
                                                                                                                                                                                                                        • Instruction ID: 433f201fbec311e4d545196cfb57db08f817b2de0d536de69a62510c51185dfe
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 85bd0f672ddd99df0f0a2a81c69a256e0952087e2de33095cd5bd9eaf017051c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 46C15D71A042058FDB24CF68C48079EBBF1BF89354F18817AE849AB796D339EC45CB95
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00412A90 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 294COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: 0
                                                                                                                                                                                                                        • API String ID: 0-4108050209
                                                                                                                                                                                                                        • Opcode ID: 7adf794be4c6c9f156d55b57fe4938e6437273bc955ed6dda0050f882a06c093
                                                                                                                                                                                                                        • Instruction ID: 5dacb983aef9c9090e06cba1bb9e4627a9a1d687151f3e630a54116cb97c77b1
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7adf794be4c6c9f156d55b57fe4938e6437273bc955ed6dda0050f882a06c093
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: ABC15C71A042058BDB14CF28C6847DEBBF1BF88340F19855AE949EB355E378EC91CB99
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0502A740 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 164windowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setColorGroup@QPalette@@QAEXW4ColorGroup@1@ABVQBrush@@11111111@Z.QT5GUI(?,?,?,?,?,?,?,?,?,?), ref: 0502A87A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • QPalette, xrefs: 0502A98A
                                                                                                                                                                                                                        • BEJ1J1J1J1J1J1J1J1J1, xrefs: 0502A81F
                                                                                                                                                                                                                        • setColorGroup, xrefs: 0502A985
                                                                                                                                                                                                                        • setColorGroup(self, cr: QPalette.ColorGroup, foreground: Union[QBrush, Union[QColor, Qt.GlobalColor], QGradient], button: Union[QBrush, Union[QColor, Qt.GlobalColor], QGradient], light: Union[QBrush, Union[QColor, Qt.GlobalColor], QGradient], dark: Union[QBrus, xrefs: 0502A980
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Color$?setBrush@@11111111@Group@Group@1@Palette@@
                                                                                                                                                                                                                        • String ID: BEJ1J1J1J1J1J1J1J1J1$QPalette$setColorGroup$setColorGroup(self, cr: QPalette.ColorGroup, foreground: Union[QBrush, Union[QColor, Qt.GlobalColor], QGradient], button: Union[QBrush, Union[QColor, Qt.GlobalColor], QGradient], light: Union[QBrush, Union[QColor, Qt.GlobalColor], QGradient], dark: Union[QBrus
                                                                                                                                                                                                                        • API String ID: 3106302329-683431584
                                                                                                                                                                                                                        • Opcode ID: 65c97de34266622048106e64d628eccf4351e4757a060c1dd44249facdd5d701
                                                                                                                                                                                                                        • Instruction ID: 649aeaff4fb93ced8f58ea8297cbaaeadd710c85d706ce2deeadb93f348184fb
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 65c97de34266622048106e64d628eccf4351e4757a060c1dd44249facdd5d701
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0B61C775118200AFD756CF94DD81EAABBF6FB88300F00494DF69583260DB76E998DF12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05096640 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 94windowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?availableSizes@QIconEngine@@UBE?AV?$QList@VQSize@@@@W4Mode@QIcon@@W4State@4@@Z.QT5GUI(?,?,?), ref: 050966F4
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • availableSizes(self, mode: QIcon.Mode = QIcon.Normal, state: QIcon.State = QIcon.Off) -> List[QSize], xrefs: 0509674C
                                                                                                                                                                                                                        • QIconEngine, xrefs: 05096756
                                                                                                                                                                                                                        • availableSizes, xrefs: 05096751
                                                                                                                                                                                                                        • B|EE, xrefs: 050966A5
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?availableEngine@@IconIcon@@List@Mode@Size@@@@Sizes@State@4@@
                                                                                                                                                                                                                        • String ID: B|EE$QIconEngine$availableSizes$availableSizes(self, mode: QIcon.Mode = QIcon.Normal, state: QIcon.State = QIcon.Off) -> List[QSize]
                                                                                                                                                                                                                        • API String ID: 2127043825-1398644414
                                                                                                                                                                                                                        • Opcode ID: c9f120423541ae4bbb533bafdd4d240b9ee3f8f7fb50a51dafdd7f1eff9c2a1a
                                                                                                                                                                                                                        • Instruction ID: 93016d0ee855a1d1f58c7f9578398c1a83013d260d5aa20b89a7db308d94338a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c9f120423541ae4bbb533bafdd4d240b9ee3f8f7fb50a51dafdd7f1eff9c2a1a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3F319074244302AFDB00DF64ED81EAABBE6FB88300F444858F94587260DB75E959DF51
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05034480 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyType_IsSubtype.PYTHON3(?,057FD218), ref: 05034498
                                                                                                                                                                                                                        • ??ZQVector3D@@QAEAAV0@ABV0@@Z.QT5GUI(?), ref: 05034505
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(?), ref: 05034537
                                                                                                                                                                                                                        • PyErr_Clear.PYTHON3 ref: 0503454C
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ClearDeallocErr_SubtypeType_V0@@Vector3
                                                                                                                                                                                                                        • String ID: 1J9
                                                                                                                                                                                                                        • API String ID: 4166087171-2407233842
                                                                                                                                                                                                                        • Opcode ID: faf751ef2938e81ee6e7e6aa4cebf363ebdae06c4c186c05f9c31c285f271ad4
                                                                                                                                                                                                                        • Instruction ID: 3407321809ff62bc163487aad3419e51d224c42af319a9e356c219267958ce54
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: faf751ef2938e81ee6e7e6aa4cebf363ebdae06c4c186c05f9c31c285f271ad4
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1621A6716142009FCB54CF68F88A96E77E9FB85321B24452DF856CB391DB74E846CB11
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05040790 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyType_IsSubtype.PYTHON3(?,057FD028), ref: 050407A8
                                                                                                                                                                                                                        • ??YQVector2D@@QAEAAV0@ABV0@@Z.QT5GUI(?), ref: 05040815
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(?), ref: 05040847
                                                                                                                                                                                                                        • PyErr_Clear.PYTHON3 ref: 0504085C
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ClearDeallocErr_SubtypeType_V0@@Vector2
                                                                                                                                                                                                                        • String ID: 1J9
                                                                                                                                                                                                                        • API String ID: 2404795029-2407233842
                                                                                                                                                                                                                        • Opcode ID: c63eecc600195a2bd4062af8639a56093c52a697a812a4a1faeb08c801f442b8
                                                                                                                                                                                                                        • Instruction ID: f302c0e095c2605be6896919fc799497b556221a48097dacbca2a93f10c09e24
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c63eecc600195a2bd4062af8639a56093c52a697a812a4a1faeb08c801f442b8
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CF21E4B12042009FC744CF68E99996E7BE5FB88321B24057DF99ADB390DB31E846CF51
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0509C790 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyType_IsSubtype.PYTHON3(?,057B5BC8), ref: 0509C7A8
                                                                                                                                                                                                                        • ??YQMatrix4x4@@QAEAAV0@ABV0@@Z.QT5GUI(?), ref: 0509C815
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(?), ref: 0509C847
                                                                                                                                                                                                                        • PyErr_Clear.PYTHON3 ref: 0509C85C
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ClearDeallocErr_Matrix4x4@@SubtypeType_V0@@
                                                                                                                                                                                                                        • String ID: 1J9
                                                                                                                                                                                                                        • API String ID: 1138325737-2407233842
                                                                                                                                                                                                                        • Opcode ID: cb96c5f36d3361827708512df4cb9845bd229d78e7e196965b76658251a7b6d1
                                                                                                                                                                                                                        • Instruction ID: 66bfd5662ab22ba6a16f1b6b8d6d73f4823e4e8c8a71f0341929ed68fda97b0a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: cb96c5f36d3361827708512df4cb9845bd229d78e7e196965b76658251a7b6d1
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6A21D6756142009FEB58CF68E8859AE77E5FF88321B24492DF45AC3390DB70EC46DB51
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0504C6C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyType_IsSubtype.PYTHON3(?,057D29D8), ref: 0504C6D8
                                                                                                                                                                                                                        • ??_5QPainterPath@@QAEAAV0@ABV0@@Z.QT5GUI(?), ref: 0504C745
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(?), ref: 0504C777
                                                                                                                                                                                                                        • PyErr_Clear.PYTHON3 ref: 0504C78C
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ??_5ClearDeallocErr_PainterPath@@SubtypeType_V0@@
                                                                                                                                                                                                                        • String ID: 1J9
                                                                                                                                                                                                                        • API String ID: 3782086040-2407233842
                                                                                                                                                                                                                        • Opcode ID: 0da4485de67446ace64f8a9e01a08d4e124ce831831974bef9f7b6934e22f784
                                                                                                                                                                                                                        • Instruction ID: 19db8630be0e4a8e8364d6da7c5b3d02169ad006e10668a26c2d54bbbffc715e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0da4485de67446ace64f8a9e01a08d4e124ce831831974bef9f7b6934e22f784
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B221EFB1205200DFE744CF68E98596EBBE6FB88325B24492DF95AC3290DB75EC42CF10
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05008650 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 82COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?pictureFormat@QPictureIO@@SA?AVQByteArray@@ABVQString@@@Z.QT5GUI(00000000,?,00000004), ref: 050086A3
                                                                                                                                                                                                                        • ?pictureFormat@QPictureIO@@SA?AVQByteArray@@PAVQIODevice@@@Z.QT5GUI(00000000,?,00000004), ref: 05008715
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • pictureFormat(fileName: Optional[str]) -> QByteArraypictureFormat(a0: Optional[QIODevice]) -> QByteArray, xrefs: 0500873B
                                                                                                                                                                                                                        • QPictureIO, xrefs: 05008745
                                                                                                                                                                                                                        • pictureFormat, xrefs: 05008740
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?pictureArray@@ByteFormat@Picture$Device@@@String@@@malloc
                                                                                                                                                                                                                        • String ID: QPictureIO$pictureFormat$pictureFormat(fileName: Optional[str]) -> QByteArraypictureFormat(a0: Optional[QIODevice]) -> QByteArray
                                                                                                                                                                                                                        • API String ID: 3002846332-1618977619
                                                                                                                                                                                                                        • Opcode ID: a32479b8a3737a1ecdbe21dd20f67d3a3a572b9908adb05ce5b43d626e6ed908
                                                                                                                                                                                                                        • Instruction ID: ed3a3e793b67b1f3b196ac2ce8a7ea5d447141db7d4d20c6f8d340e3fb066354
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a32479b8a3737a1ecdbe21dd20f67d3a3a572b9908adb05ce5b43d626e6ed908
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B621D531144301AFEB01EFA8EC46FAB7BE9BB48300F044454FA08972A0D775ED89DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FF2580 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ??8QTextFormat@@QBE_NABV0@@Z.QT5GUI(?), ref: 04FF25F7
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(00000001), ref: 04FF2607
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Bool_Format@@FromLongTextV0@@
                                                                                                                                                                                                                        • String ID: 1J9
                                                                                                                                                                                                                        • API String ID: 3920592147-2407233842
                                                                                                                                                                                                                        • Opcode ID: e2d929a3ae1f15354f5b18bd44e49cdfa5e8a07371445a3c9dbd90f59e7c6ea0
                                                                                                                                                                                                                        • Instruction ID: 21a6ffb680769b06dc37460651e1e7d8dc4915df89382ee4e34a0087f32c4b67
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e2d929a3ae1f15354f5b18bd44e49cdfa5e8a07371445a3c9dbd90f59e7c6ea0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 402106715002009FCB11DF68ED86DAA3BE5BF44715F5844A8F948CB2B0EB36F95ACB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FE67C0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 79COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?drawTextItem@QPaintEngine@@UAEXABVQPointF@@ABVQTextItem@@@Z.QT5GUI(?,?), ref: 04FE6854
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • QPaintEngine, xrefs: 04FE68AA
                                                                                                                                                                                                                        • drawTextItem, xrefs: 04FE68A5
                                                                                                                                                                                                                        • BJ1J9, xrefs: 04FE6822
                                                                                                                                                                                                                        • drawTextItem(self, p: Union[QPointF, QPoint], textItem: QTextItem), xrefs: 04FE68A0
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Text$?drawEngine@@Item@Item@@@PaintPoint
                                                                                                                                                                                                                        • String ID: BJ1J9$QPaintEngine$drawTextItem$drawTextItem(self, p: Union[QPointF, QPoint], textItem: QTextItem)
                                                                                                                                                                                                                        • API String ID: 2595911123-2298801278
                                                                                                                                                                                                                        • Opcode ID: 46775a4f809273efcef8ac5d88818e9b3ed0981eb9a7fe90c70d024522a9b5d3
                                                                                                                                                                                                                        • Instruction ID: 33f0dcbaa42893dad9e62bde3e38c0b55c5694f3eee1b0853d84a8d9cd31faf6
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 46775a4f809273efcef8ac5d88818e9b3ed0981eb9a7fe90c70d024522a9b5d3
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8121A231254205AFE701DFA4DC81E6A7BE9FB48311F440868F958C7260EB76E95ADB11
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00407564 Relevance: 8.8, APIs: 7, Instructions: 77stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: strlen$malloc
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3157260142-0
                                                                                                                                                                                                                        • Opcode ID: 0610461012db69685dc33115d6b204908d610f74a8049d1f7c086d9be229f820
                                                                                                                                                                                                                        • Instruction ID: 6a25df0a465119ab13b362e17adcb34b3197186f0404beced398dc7aaf439a95
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0610461012db69685dc33115d6b204908d610f74a8049d1f7c086d9be229f820
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B5217175A0A7059BC710AF6988846ABB7E0FF84750F46493EF8C497341FA39EC41C796
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0506C760 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 75COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: FromLongLong_
                                                                                                                                                                                                                        • String ID: iii$qGray$qGray(r: int, g: int, b: int) -> intqGray(rgb: int) -> int
                                                                                                                                                                                                                        • API String ID: 2938811853-1330036195
                                                                                                                                                                                                                        • Opcode ID: 37f28b6ce8b607f423c8779317e5d3034d1d5b2e5244fb2b279674327bc608c9
                                                                                                                                                                                                                        • Instruction ID: 8f4a4ed0af7f5fb3fa0f69d8f34c9702e4ca32858448bac1cef1fb0db5ed99d4
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 37f28b6ce8b607f423c8779317e5d3034d1d5b2e5244fb2b279674327bc608c9
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 842129B5604201AFD304DB68DC45E6E77E8FBC4301F44887DF998D7251EA38EA19CB42
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FFE4F0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setMarkdown@QTextDocument@@QAEXABVQString@@V?$QFlags@W4MarkdownFeature@QTextDocument@@@@@Z.QT5GUI(?,00000000), ref: 04FFE584
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • QTextDocument, xrefs: 04FFE5EA
                                                                                                                                                                                                                        • BJ1|J1, xrefs: 04FFE54A
                                                                                                                                                                                                                        • setMarkdown, xrefs: 04FFE5E5
                                                                                                                                                                                                                        • setMarkdown(self, markdown: Optional[str], features: Union[QTextDocument.MarkdownFeatures, QTextDocument.MarkdownFeature] = QTextDocument.MarkdownDialectGitHub), xrefs: 04FFE5E0
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Text$?setDocument@@Document@@@@@Feature@Flags@MarkdownMarkdown@String@@
                                                                                                                                                                                                                        • String ID: BJ1|J1$QTextDocument$setMarkdown$setMarkdown(self, markdown: Optional[str], features: Union[QTextDocument.MarkdownFeatures, QTextDocument.MarkdownFeature] = QTextDocument.MarkdownDialectGitHub)
                                                                                                                                                                                                                        • API String ID: 4162315510-1142115851
                                                                                                                                                                                                                        • Opcode ID: 0d9fbb3e0fd060aee333b445598532966299bccc9746e9642780ed94bd4aba46
                                                                                                                                                                                                                        • Instruction ID: a4dc22cf3c6e3e673965962b7970aeb4cf1a183fd5ba9fe009efb22e2fdc6a32
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0d9fbb3e0fd060aee333b445598532966299bccc9746e9642780ed94bd4aba46
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BF314970118205AFD701DF94DC81E6ABBF9FB88300F104868F984C7261DB76E959DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050944D0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 73windowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?addPixmap@QIconEngine@@UAEXABVQPixmap@@W4Mode@QIcon@@W4State@4@@Z.QT5GUI(?,?,?), ref: 05094566
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • QIconEngine, xrefs: 050945A1
                                                                                                                                                                                                                        • addPixmap, xrefs: 0509459C
                                                                                                                                                                                                                        • addPixmap(self, pixmap: QPixmap, mode: QIcon.Mode, state: QIcon.State), xrefs: 05094597
                                                                                                                                                                                                                        • BJ9EE, xrefs: 05094530
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?addEngine@@IconIcon@@Mode@Pixmap@Pixmap@@State@4@@
                                                                                                                                                                                                                        • String ID: BJ9EE$QIconEngine$addPixmap$addPixmap(self, pixmap: QPixmap, mode: QIcon.Mode, state: QIcon.State)
                                                                                                                                                                                                                        • API String ID: 2531662513-757124601
                                                                                                                                                                                                                        • Opcode ID: b04498eea796c768c1ce970e392214a8275ec13389db5ec1c5017e505f6f113a
                                                                                                                                                                                                                        • Instruction ID: 06645e32966043cf3f793298629503b158e567f16b27deb58cfd45fea5dc7ba4
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b04498eea796c768c1ce970e392214a8275ec13389db5ec1c5017e505f6f113a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4F216570258201EFDF44DFA4DC81D6A7BEAFB44300F840868F955C7261E775E95ADB11
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FF6790 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 72COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?sort@QStandardItemModel@@UAEXHW4SortOrder@Qt@@@Z.QT5GUI(?,?), ref: 04FF6824
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?sort@ItemModel@@Order@Qt@@@SortStandard
                                                                                                                                                                                                                        • String ID: Bi|E$QStandardItemModel$sort$sort(self, column: int, order: Qt.SortOrder = Qt.AscendingOrder)
                                                                                                                                                                                                                        • API String ID: 760300712-3174692600
                                                                                                                                                                                                                        • Opcode ID: 189fccdb724803eeb38c279702c541751152566d65186c16adadc5c41fcf0a7a
                                                                                                                                                                                                                        • Instruction ID: 95ebe804b1842e0df0d3866075004e6ab730c53ea26ce90fa395ef769caaf8db
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 189fccdb724803eeb38c279702c541751152566d65186c16adadc5c41fcf0a7a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 24218E31208201AFE700DF64DD86F6A7BE8EF48704F544858FA58D7261EB76EC4ADB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FE6480 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 67COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setRange@QIntValidator@@UAEXHH@Z.QT5GUI(?,?), ref: 04FE64FB
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?setRange@Validator@@
                                                                                                                                                                                                                        • String ID: Bii$QIntValidator$setRange$setRange(self, bottom: int, top: int)
                                                                                                                                                                                                                        • API String ID: 2470182848-2107186230
                                                                                                                                                                                                                        • Opcode ID: 4cae0d23ab6608d700c375a002165bb23c02632e4468a703860a09b84673f927
                                                                                                                                                                                                                        • Instruction ID: 4eccad791f2e78d9692a038e0c249806724fda5bf4dabef2a483606880990f20
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4cae0d23ab6608d700c375a002165bb23c02632e4468a703860a09b84673f927
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C721D235344306AFE740DFA4DC81DAA7BE8FB98315F944868F858C7260E735E94ADB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FE84E0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?disconnectNotify@QObject@@MAEXABVQMetaMethod@@@Z.QT5CORE(?), ref: 04FE8558
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?disconnectMetaMethod@@@Notify@Object@@
                                                                                                                                                                                                                        • String ID: BJ9$QStandardItemModel$connectNotify$connectNotify(self, signal: QMetaMethod)
                                                                                                                                                                                                                        • API String ID: 1574910395-2748816429
                                                                                                                                                                                                                        • Opcode ID: cc79c55904227572dbd49c9891f8cacb4029a68f77f56b9bf30305ea3f804191
                                                                                                                                                                                                                        • Instruction ID: 99c237b5fe2dc0311466b4c169b6380661640a5651d8764e06b8de0a33d3b693
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: cc79c55904227572dbd49c9891f8cacb4029a68f77f56b9bf30305ea3f804191
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CB219030644301AFD701EBA4D882EBA7BE9FB48350F540424FC18C72A0EB36E94ADB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FE44A0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?disconnectNotify@QObject@@MAEXABVQMetaMethod@@@Z.QT5CORE(?), ref: 04FE4518
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?disconnectMetaMethod@@@Notify@Object@@
                                                                                                                                                                                                                        • String ID: BJ8$QIntValidator$customEvent$customEvent(self, a0: Optional[QEvent])
                                                                                                                                                                                                                        • API String ID: 1574910395-1576208025
                                                                                                                                                                                                                        • Opcode ID: dddef4dc4573e742e749491ef3a97dc639c27c030585e87d6a4e4b125346c851
                                                                                                                                                                                                                        • Instruction ID: dc7675ce4a7b8c8ceb331baf2ffa056feec3a36c8dc844fffe414305b721b1e5
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: dddef4dc4573e742e749491ef3a97dc639c27c030585e87d6a4e4b125346c851
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3F214D712542019FE700DBA5ED82EBA7BE5FB48315F140469FD48C7260EB35F94ADB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0505C580 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?blockInserted@QTextBlockGroup@@MAEXABVQTextBlock@@@Z.QT5GUI(?), ref: 0505C5F8
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Text$?blockBlockBlock@@@Group@@Inserted@
                                                                                                                                                                                                                        • String ID: BJ9$QTextList$blockInserted$blockInserted(self, block: QTextBlock)
                                                                                                                                                                                                                        • API String ID: 2556882614-1508678766
                                                                                                                                                                                                                        • Opcode ID: a2d7321348763988d02b689827d07fd26d6689097b138fa26e2aa97126c41888
                                                                                                                                                                                                                        • Instruction ID: 5fb966a6ce114d82c5564a5f88f27ac1486051aff13f27ea4ac46bdcd0f0ab92
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a2d7321348763988d02b689827d07fd26d6689097b138fa26e2aa97126c41888
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CC2190342583029FE701DBA4EC85E6A7BE9FB88310F044464FC49D7260E775EE49DB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050545A0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?disconnectNotify@QObject@@MAEXABVQMetaMethod@@@Z.QT5CORE(?), ref: 05054618
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?disconnectMetaMethod@@@Notify@Object@@
                                                                                                                                                                                                                        • String ID: BJ8$QTextObject$customEvent$customEvent(self, a0: Optional[QEvent])
                                                                                                                                                                                                                        • API String ID: 1574910395-2369609998
                                                                                                                                                                                                                        • Opcode ID: 59dd6710c607c720360231c6884981fbdd45f091368835833a8758edb5fa6443
                                                                                                                                                                                                                        • Instruction ID: 33180f2f6ff4ce24e63f2a15528e9536ae2b7447c7fe7cd02e9fc25b4f16911e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 59dd6710c607c720360231c6884981fbdd45f091368835833a8758edb5fa6443
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 752175342582019FDB40CBA4E982EAE7BE5FB48314F144464FD49C7260E775ED9DDB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050485B0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?tabletEvent@QWindow@@MAEXPAVQTabletEvent@@@Z.QT5GUI(?), ref: 05048628
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?tabletEvent@Event@@@TabletWindow@@
                                                                                                                                                                                                                        • String ID: BJ8$QRasterWindow$keyPressEvent$keyPressEvent(self, a0: Optional[QKeyEvent])
                                                                                                                                                                                                                        • API String ID: 2314446140-59065325
                                                                                                                                                                                                                        • Opcode ID: 89d71b20bcdc23099c87c31860f5d511bcf7d44a3bdafe8805c476aeb07287cb
                                                                                                                                                                                                                        • Instruction ID: f4f03c0ffdef78d9bb6003abddc3fa74a1b6a8d6899b6df423603e6fadd6fef7
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 89d71b20bcdc23099c87c31860f5d511bcf7d44a3bdafe8805c476aeb07287cb
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3A219074258201AFD740CBA4E886E6E7BE5FF48310F548864FC58C7260DB75E949DB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FF0420 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?disconnectNotify@QObject@@MAEXABVQMetaMethod@@@Z.QT5CORE(?), ref: 04FF0498
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?disconnectMetaMethod@@@Notify@Object@@
                                                                                                                                                                                                                        • String ID: BJ8$QValidator$customEvent$customEvent(self, a0: Optional[QEvent])
                                                                                                                                                                                                                        • API String ID: 1574910395-2404682530
                                                                                                                                                                                                                        • Opcode ID: 3598b3ab207213394f590a42af3b4bacfcf424cc7ed097239e48d736225cf3b6
                                                                                                                                                                                                                        • Instruction ID: dbb7ac53fd11f4cdfe76f34a28cfaa44171d9725c094bd66ba7b13a7f2129940
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3598b3ab207213394f590a42af3b4bacfcf424cc7ed097239e48d736225cf3b6
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D6215E752442019FE700CBA4ED86E6A7BE4FF48314F144464FD48C7262EB35F94ADB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FF05F0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?disconnectNotify@QObject@@MAEXABVQMetaMethod@@@Z.QT5CORE(?), ref: 04FF0668
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?disconnectMetaMethod@@@Notify@Object@@
                                                                                                                                                                                                                        • String ID: BJ9$QValidator$connectNotify$connectNotify(self, signal: QMetaMethod)
                                                                                                                                                                                                                        • API String ID: 1574910395-1744049353
                                                                                                                                                                                                                        • Opcode ID: dcf32b20c41dea9f28ebc825decb3049db2e0574167cb0fec7e14dcb796d9e4b
                                                                                                                                                                                                                        • Instruction ID: 310e8027771e585a9900e4e0bc665321ad76e20c285c7b6a324863d0521e7eab
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: dcf32b20c41dea9f28ebc825decb3049db2e0574167cb0fec7e14dcb796d9e4b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C2219D70244202AFDB00CFA4DC82EAA7BE5FF88710F144464F948D7271EB35E94ADB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0508A480 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?disconnectNotify@QObject@@MAEXABVQMetaMethod@@@Z.QT5CORE(?), ref: 0508A4F8
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?disconnectMetaMethod@@@Notify@Object@@
                                                                                                                                                                                                                        • String ID: BJ8$QOpenGLWindow$timerEvent$timerEvent(self, a0: Optional[QTimerEvent])
                                                                                                                                                                                                                        • API String ID: 1574910395-2890960590
                                                                                                                                                                                                                        • Opcode ID: 94b204738e418082e98291068f16b497efa7673c6c5e80119c1b1d65b219a6df
                                                                                                                                                                                                                        • Instruction ID: ea02f6244bf9f1720a32488c8314a9b2ea50bfda44dfae043c00f8a00b1dfbd1
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 94b204738e418082e98291068f16b497efa7673c6c5e80119c1b1d65b219a6df
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 70218E30358201AFD600DBA4E885E7A7BE5FB88320F144465FD49C7660EB76E989DB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05014490 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?tabletEvent@QWindow@@MAEXPAVQTabletEvent@@@Z.QT5GUI(?), ref: 05014508
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?tabletEvent@Event@@@TabletWindow@@
                                                                                                                                                                                                                        • String ID: BJ8$QWindow$resizeEvent$resizeEvent(self, a0: Optional[QResizeEvent])
                                                                                                                                                                                                                        • API String ID: 2314446140-3739113224
                                                                                                                                                                                                                        • Opcode ID: 5d3f7eeabf0f65b00b4dc166f2f7a5ed805d5eaa5b26bd12a15bc3211a0835f3
                                                                                                                                                                                                                        • Instruction ID: f7fbea821dcb5931572ab7f6533692b9a4f022b8649d2687df9ed9b0ce939785
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5d3f7eeabf0f65b00b4dc166f2f7a5ed805d5eaa5b26bd12a15bc3211a0835f3
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: EC218E702482019FDB40CBA4E882E6A7BE5FB48714F540464FD49C7260EB75E94ADB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0504A4F0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?disconnectNotify@QObject@@MAEXABVQMetaMethod@@@Z.QT5CORE(?), ref: 0504A568
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?disconnectMetaMethod@@@Notify@Object@@
                                                                                                                                                                                                                        • String ID: BJ8$QTextFrame$timerEvent$timerEvent(self, a0: Optional[QTimerEvent])
                                                                                                                                                                                                                        • API String ID: 1574910395-988521775
                                                                                                                                                                                                                        • Opcode ID: 9c1143c50f1ec61118eab9c68f123c46f8c023e4dfd9595b4733d620bbf84186
                                                                                                                                                                                                                        • Instruction ID: d63f86ec95a7028fef4d2dade26a5b19756759856b449f278f25d1f5350b847b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9c1143c50f1ec61118eab9c68f123c46f8c023e4dfd9595b4733d620bbf84186
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CF219075388201AFD700CBA4E981E6A7BF6FB48210F440464F949C7260EB75E999DF12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050864F0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?disconnectNotify@QObject@@MAEXABVQMetaMethod@@@Z.QT5CORE(?), ref: 05086568
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?disconnectMetaMethod@@@Notify@Object@@
                                                                                                                                                                                                                        • String ID: BJ8$QMovie$childEvent$childEvent(self, a0: Optional[QChildEvent])
                                                                                                                                                                                                                        • API String ID: 1574910395-878183645
                                                                                                                                                                                                                        • Opcode ID: 7a8ad17da0f8905b42e30539097ba190be0b622c39d899c9be811cf79cb7b030
                                                                                                                                                                                                                        • Instruction ID: 8776172f0a0f39a01f3ec131cef1d489febb0398963e6101b4f0ed7c9f431274
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7a8ad17da0f8905b42e30539097ba190be0b622c39d899c9be811cf79cb7b030
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A1219074258201AFD740DFA4EC82E7A7BE9FB48310F440464FD88C7260EB36E94ADB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0509C4F0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?disconnectNotify@QObject@@MAEXABVQMetaMethod@@@Z.QT5CORE(?), ref: 0509C568
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?disconnectMetaMethod@@@Notify@Object@@
                                                                                                                                                                                                                        • String ID: BJ8$QOpenGLVertexArrayObject$timerEvent$timerEvent(self, a0: Optional[QTimerEvent])
                                                                                                                                                                                                                        • API String ID: 1574910395-2375769964
                                                                                                                                                                                                                        • Opcode ID: 34ef30804c042dd37b358fd423abff8c50fe8f7d44c8283226ca755b7187b0e1
                                                                                                                                                                                                                        • Instruction ID: f9243bba56ec398d59800e23b8207affeba8d7813aec2ddfc713b65aa43807dd
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 34ef30804c042dd37b358fd423abff8c50fe8f7d44c8283226ca755b7187b0e1
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F12175706482029FEB44DFA4E885E6A77E5FB48310F540464FD49C7260EB75EDC9EB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FE46D0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?disconnectNotify@QObject@@MAEXABVQMetaMethod@@@Z.QT5CORE(?), ref: 04FE4748
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?disconnectMetaMethod@@@Notify@Object@@
                                                                                                                                                                                                                        • String ID: BJ9$QIntValidator$connectNotify$connectNotify(self, signal: QMetaMethod)
                                                                                                                                                                                                                        • API String ID: 1574910395-3158772116
                                                                                                                                                                                                                        • Opcode ID: a4082a0913961e699d7e334576c037a9a780879b539dd79f8a033a75bdc52676
                                                                                                                                                                                                                        • Instruction ID: 3ba80ebd5965a5e2afef8974cb086b7c679da75fffe0de6128fa1742ea707ef0
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a4082a0913961e699d7e334576c037a9a780879b539dd79f8a033a75bdc52676
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1F219D34254202AFDB00CFA5DD82EBA7BE5FB48305F140468F858C72A0EB75F94ADB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0504A7B0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?tabletEvent@QWindow@@MAEXPAVQTabletEvent@@@Z.QT5GUI(?), ref: 0504A828
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?tabletEvent@Event@@@TabletWindow@@
                                                                                                                                                                                                                        • String ID: BJ8$QRasterWindow$tabletEvent$tabletEvent(self, a0: Optional[QTabletEvent])
                                                                                                                                                                                                                        • API String ID: 2314446140-3256538024
                                                                                                                                                                                                                        • Opcode ID: 604efc5ca8c217d5b0b331b08efe4bf0723b6b213e0e253f9fa2a323b05b7a7d
                                                                                                                                                                                                                        • Instruction ID: 662fdbc194f896ca54fe3b019277540a60c09adfea30a9359f1c1a0313e50de3
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 604efc5ca8c217d5b0b331b08efe4bf0723b6b213e0e253f9fa2a323b05b7a7d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A0218E74358201AFD700CBA4EC82E6A7BE6FB48300F144478FD59C7260EB75E94ADB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050167D0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?tabletEvent@QWindow@@MAEXPAVQTabletEvent@@@Z.QT5GUI(?), ref: 05016848
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?tabletEvent@Event@@@TabletWindow@@
                                                                                                                                                                                                                        • String ID: BJ8$QWindow$keyReleaseEvent$keyReleaseEvent(self, a0: Optional[QKeyEvent])
                                                                                                                                                                                                                        • API String ID: 2314446140-729342036
                                                                                                                                                                                                                        • Opcode ID: 3038e11f16e660eb5627ffec73ab17d919b6d299e0605df7058f3630b84c0fb2
                                                                                                                                                                                                                        • Instruction ID: a2a9f181d6885b776b0c83e3cce1907587b262e8fe5379dbbc313871dcbc0773
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3038e11f16e660eb5627ffec73ab17d919b6d299e0605df7058f3630b84c0fb2
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B92190342482019FD740CFA4ED86E6E7BE5FB88300F140464FD59C7660DB36E949DB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0508A7D0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?disconnectNotify@QObject@@MAEXABVQMetaMethod@@@Z.QT5CORE(?), ref: 0508A848
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?disconnectMetaMethod@@@Notify@Object@@
                                                                                                                                                                                                                        • String ID: BJ8$QOpenGLWindow$childEvent$childEvent(self, a0: Optional[QChildEvent])
                                                                                                                                                                                                                        • API String ID: 1574910395-842962294
                                                                                                                                                                                                                        • Opcode ID: 261827b86082a6aa2d34c0ee825b48f65057d85247d8bf2b232ef617c07b5ded
                                                                                                                                                                                                                        • Instruction ID: 9235682f51db78f072d0906ce14c77e1202c670112a611cb0b624402d16a00f5
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 261827b86082a6aa2d34c0ee825b48f65057d85247d8bf2b232ef617c07b5ded
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1D216D342182029FD640DBA4ED81E7A7BE5FB48320F140469FD89C7660EB35E98ADB11
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0505A7E0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?disconnectNotify@QObject@@MAEXABVQMetaMethod@@@Z.QT5CORE(?), ref: 0505A858
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?disconnectMetaMethod@@@Notify@Object@@
                                                                                                                                                                                                                        • String ID: BJ8$QDoubleValidator$customEvent$customEvent(self, a0: Optional[QEvent])
                                                                                                                                                                                                                        • API String ID: 1574910395-1569424415
                                                                                                                                                                                                                        • Opcode ID: f587391bb8db4ccc6475c8f2e24dfd89cca716f1147ccde65d19c0d84c663d06
                                                                                                                                                                                                                        • Instruction ID: 6da983f93771a4cf1dc39cfa5313aa1556429a99eb4a6b624a37b4a814d36523
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f587391bb8db4ccc6475c8f2e24dfd89cca716f1147ccde65d19c0d84c663d06
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 682190343482019FE740CBA4E886EBA7BE5FB48324F140564FC49C72A0EB35E94ADB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0508C630 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?tabletEvent@QWindow@@MAEXPAVQTabletEvent@@@Z.QT5GUI(?), ref: 0508C6A8
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?tabletEvent@Event@@@TabletWindow@@
                                                                                                                                                                                                                        • String ID: BJ8$QOpenGLWindow$showEvent$showEvent(self, a0: Optional[QShowEvent])
                                                                                                                                                                                                                        • API String ID: 2314446140-1441172449
                                                                                                                                                                                                                        • Opcode ID: 18bab9ea8a365017cad9071bb3404a58522eed5b6539d833afbe39e55478ef90
                                                                                                                                                                                                                        • Instruction ID: 7259f28b3717917d9ddb418f6aebdc9222e62e6503590b0437eb18d632805c70
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 18bab9ea8a365017cad9071bb3404a58522eed5b6539d833afbe39e55478ef90
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 852181702482019FE640DBA4E881E6A7BF5FB48210F140474F949CB260D775ED59DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05070650 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setMargins@QPagedPaintDevice@@UAEXABUMargins@1@@Z.QT5GUI(?), ref: 050706C8
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?setDevice@@Margins@Margins@1@@PagedPaint
                                                                                                                                                                                                                        • String ID: BJ9$QPagedPaintDevice$setMargins$setMargins(self, margins: QPagedPaintDevice.Margins)
                                                                                                                                                                                                                        • API String ID: 951796424-2120146140
                                                                                                                                                                                                                        • Opcode ID: a04a95a73b5f02b0d5d586a896df78fe8dcf444af5c7c4e9039c605524de862d
                                                                                                                                                                                                                        • Instruction ID: e718867be7b2d2bd5e105198e70de8a9e0a034703c27e11da8819813e51f950e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a04a95a73b5f02b0d5d586a896df78fe8dcf444af5c7c4e9039c605524de862d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D121A230248205AFD700CBA4EDA6E6A7BE5FB88214F140524FD49D7260DB75E949DF16
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05022660 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 65COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?disconnectNotify@QObject@@MAEXABVQMetaMethod@@@Z.QT5CORE(?), ref: 050226D8
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?disconnectMetaMethod@@@Notify@Object@@
                                                                                                                                                                                                                        • String ID: BJ8$QPdfWriter$customEvent$customEvent(self, a0: Optional[QEvent])
                                                                                                                                                                                                                        • API String ID: 1574910395-112237231
                                                                                                                                                                                                                        • Opcode ID: 072c0bc39055fe59fe8e452ac6f7572eac890e2cc4b5f5bb7025398055e8d817
                                                                                                                                                                                                                        • Instruction ID: 835a205827702c8ea139f1eb39b1ad2c945a9364552eefeba2bdbdd8e3dae6b8
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 072c0bc39055fe59fe8e452ac6f7572eac890e2cc4b5f5bb7025398055e8d817
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B3217F39258202AFDB40CFA4ED86EAE7BE5FB48310F544464FC49C7260EB35E959DB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05072740 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?fromImageReader@QPixmap@@SA?AV1@PAVQImageReader@@V?$QFlags@W4ImageConversionFlag@Qt@@@@@Z.QT5GUI(00000000,?,00000010,00000010), ref: 050727BF
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • fromImageReader, xrefs: 05072808
                                                                                                                                                                                                                        • J8|J1, xrefs: 05072781
                                                                                                                                                                                                                        • fromImageReader(imageReader: Optional[QImageReader], flags: Union[Qt.ImageConversionFlags, Qt.ImageConversionFlag] = Qt.AutoColor) -> QPixmap, xrefs: 05072803
                                                                                                                                                                                                                        • QPixmap, xrefs: 0507280D
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Image$?fromConversionFlag@Flags@Pixmap@@Qt@@@@@Reader@Reader@@malloc
                                                                                                                                                                                                                        • String ID: J8|J1$QPixmap$fromImageReader$fromImageReader(imageReader: Optional[QImageReader], flags: Union[Qt.ImageConversionFlags, Qt.ImageConversionFlag] = Qt.AutoColor) -> QPixmap
                                                                                                                                                                                                                        • API String ID: 3909715074-1214915771
                                                                                                                                                                                                                        • Opcode ID: b20e734a5f0e93f14060a9cc6eaa41bdccd37e50fff7a33d98d2f1ac97e843ea
                                                                                                                                                                                                                        • Instruction ID: 55b68c3069439ec1cabcbcb28a9e1c9ed864e3d5ddad68809e56d13582eb6560
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b20e734a5f0e93f14060a9cc6eaa41bdccd37e50fff7a33d98d2f1ac97e843ea
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3D21BE74104302AFD701DFA4DD42F9A7BF6FB88300F404818F95486260DBB6E999DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05020650 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 64COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?contains@QRegion@@QBE_NABVQPoint@@@Z.QT5GUI(?), ref: 050206B3
                                                                                                                                                                                                                        • ?contains@QRegion@@QBE_NABVQRect@@@Z.QT5GUI(?), ref: 050206F4
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?contains@Region@@$Point@@@Rect@@@
                                                                                                                                                                                                                        • String ID: 1J9$QRegion$__contains__
                                                                                                                                                                                                                        • API String ID: 3584751728-2427734027
                                                                                                                                                                                                                        • Opcode ID: 8da0cbde7a625c9473dbb7018003f56f1009670a5f933797846f5143501b5156
                                                                                                                                                                                                                        • Instruction ID: fc14f9a9285169bb4ba8ffc0a3773fb3d3189e293bde6adb5d4df1ff4c38e27c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8da0cbde7a625c9473dbb7018003f56f1009670a5f933797846f5143501b5156
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B0110331114311AFDB01DBA8EC46EAE7BE5BF88711F444464FD88C32A0EB39D999DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05038420 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 58COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?strokePath@QPainter@@QAEXABVQPainterPath@@ABVQPen@@@Z.QT5GUI(?,?), ref: 0503848B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • BJ9J1, xrefs: 0503845D
                                                                                                                                                                                                                        • strokePath, xrefs: 050384D3
                                                                                                                                                                                                                        • strokePath(self, path: QPainterPath, pen: Union[QPen, Union[QColor, Qt.GlobalColor]]), xrefs: 050384CE
                                                                                                                                                                                                                        • QPainter, xrefs: 050384D8
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?strokePainterPainter@@Path@Path@@Pen@@@
                                                                                                                                                                                                                        • String ID: BJ9J1$QPainter$strokePath$strokePath(self, path: QPainterPath, pen: Union[QPen, Union[QColor, Qt.GlobalColor]])
                                                                                                                                                                                                                        • API String ID: 3053015954-3456185938
                                                                                                                                                                                                                        • Opcode ID: 9a6052eda84d3977f7dddbcff7da1de629c5a5678e2cef428da8d8fc09fcc8ee
                                                                                                                                                                                                                        • Instruction ID: cf8a73299b8a85ace2e5587e166642736b89812aea58b222fa74cd1663f4b823
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9a6052eda84d3977f7dddbcff7da1de629c5a5678e2cef428da8d8fc09fcc8ee
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 74215E71118201AFD701DFA8DD42E6A7BEAFB88704F444868F948C3260D775ED59DB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05078610 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 58COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?createMaskFromColor@QImage@@QBE?AV1@IW4MaskMode@Qt@@@Z.QT5GUI(00000000,?,?), ref: 05078689
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Bu|E, xrefs: 05078642
                                                                                                                                                                                                                        • createMaskFromColor(self, color: int, mode: Qt.MaskMode = Qt.MaskInColor) -> QImage, xrefs: 050786B5
                                                                                                                                                                                                                        • QImage, xrefs: 050786BF
                                                                                                                                                                                                                        • createMaskFromColor, xrefs: 050786BA
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Mask$?createColor@FromImage@@Mode@Qt@@@malloc
                                                                                                                                                                                                                        • String ID: Bu|E$QImage$createMaskFromColor$createMaskFromColor(self, color: int, mode: Qt.MaskMode = Qt.MaskInColor) -> QImage
                                                                                                                                                                                                                        • API String ID: 306205107-733685321
                                                                                                                                                                                                                        • Opcode ID: d0aa30b5c9a83899b58e98af1b6644904ab8c7f09c1921ba91e5603d5af4ad16
                                                                                                                                                                                                                        • Instruction ID: 9c5e229d74dff00d0996787b13a4055253ef4a7f02829c8f8d32409a8af62ae3
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d0aa30b5c9a83899b58e98af1b6644904ab8c7f09c1921ba91e5603d5af4ad16
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B311B274104302AFEB01DF94DC42FAE7BE8FB88300F444C18FA5496260EB75E999DB56
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FF44F0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 56COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?inverted@QTransform@@QBE?AV1@PA_N@Z.QT5GUI(00000000,?), ref: 04FF4549
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?inverted@Transform@@malloc
                                                                                                                                                                                                                        • String ID: (Rb)$QTransform$inverted$inverted(self) -> (QTransform, Optional[bool])
                                                                                                                                                                                                                        • API String ID: 4015783051-1947809495
                                                                                                                                                                                                                        • Opcode ID: ef17c0f590cf8f129580603464e0afade1efb7fca686d49ed297db3559f6add4
                                                                                                                                                                                                                        • Instruction ID: af418457560a1d3f9c4bedf31ac1b600b345bddbe1e6602e0ad1446b0e134f08
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ef17c0f590cf8f129580603464e0afade1efb7fca686d49ed297db3559f6add4
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2311E771258301BFE600DBA4EC42F6A3BE8AB48700F444454FA48C7290D774F999DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0502A670 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 55COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setOptions@QSurfaceFormat@@QAEXV?$QFlags@W4FormatOption@QSurfaceFormat@@@@@Z.QT5GUI(?), ref: 0502A6CE
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • setOptions(self, options: Union[QSurfaceFormat.FormatOptions, QSurfaceFormat.FormatOption]), xrefs: 0502A711
                                                                                                                                                                                                                        • BJ1, xrefs: 0502A6A2
                                                                                                                                                                                                                        • setOptions, xrefs: 0502A716
                                                                                                                                                                                                                        • QSurfaceFormat, xrefs: 0502A71B
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Surface$?setFlags@FormatFormat@@Format@@@@@Option@Options@
                                                                                                                                                                                                                        • String ID: BJ1$QSurfaceFormat$setOptions$setOptions(self, options: Union[QSurfaceFormat.FormatOptions, QSurfaceFormat.FormatOption])
                                                                                                                                                                                                                        • API String ID: 1536409420-456082314
                                                                                                                                                                                                                        • Opcode ID: 0ccea444c853c2c3ad888d61d2999463b13404cba32806387206d44cda776541
                                                                                                                                                                                                                        • Instruction ID: e346f212cecd9aa83948b1a128547cf0afcb03d8b02af138ec0f5ab7a77aa16d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0ccea444c853c2c3ad888d61d2999463b13404cba32806387206d44cda776541
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C3116334218201AFD701DF98DD81E697BF5FB88314F504858F558C7270DB75E996DB06
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05070490 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 54windowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?createHeuristicMask@QPixmap@@QBE?AVQBitmap@@_N@Z.QT5GUI(00000000,?), ref: 050704F7
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?createBitmap@@_HeuristicMask@Pixmap@@malloc
                                                                                                                                                                                                                        • String ID: B|b$QPixmap$createHeuristicMask$createHeuristicMask(self, clipTight: bool = True) -> QBitmap
                                                                                                                                                                                                                        • API String ID: 1577753046-298626512
                                                                                                                                                                                                                        • Opcode ID: e16f6c8533ae72fda1364475e2fe4bbcb58814607ae27e86abbfaa7c05e09882
                                                                                                                                                                                                                        • Instruction ID: 289ddd18819a074912ad1f72ba003e894642e1ba63ba11551d564b62f0d33492
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e16f6c8533ae72fda1364475e2fe4bbcb58814607ae27e86abbfaa7c05e09882
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BC110630144301BFDB11DBA4ED42F9A7BE5BB84700F440824F98897290D7B5EE99DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FF86F0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 54COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setAdditionalFormats@QTextLayout@@QAEXABV?$QList@UFormatRange@QTextLayout@@@@@Z.QT5GUI(?), ref: 04FF874C
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • BJ1, xrefs: 04FF8722
                                                                                                                                                                                                                        • setAdditionalFormats, xrefs: 04FF8794
                                                                                                                                                                                                                        • setAdditionalFormats(self, overrides: Iterable[QTextLayout.FormatRange]), xrefs: 04FF878F
                                                                                                                                                                                                                        • QTextLayout, xrefs: 04FF8799
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Text$?setAdditionalFormatFormats@Layout@@Layout@@@@@List@Range@
                                                                                                                                                                                                                        • String ID: BJ1$QTextLayout$setAdditionalFormats$setAdditionalFormats(self, overrides: Iterable[QTextLayout.FormatRange])
                                                                                                                                                                                                                        • API String ID: 3110664100-92635248
                                                                                                                                                                                                                        • Opcode ID: 0576d1172c0c0c1103c1868abff8d57f0a0ff2bfd4f41a0b45a399b3c4c079f0
                                                                                                                                                                                                                        • Instruction ID: c465312f84160ba07e344717929d7bcb0bd57b726df3556cb950710d3c066bb8
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0576d1172c0c0c1103c1868abff8d57f0a0ff2bfd4f41a0b45a399b3c4c079f0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 53119070214201AFE701DFA8DC82E697BE5FB88300F540958F958C7270DB75E95ADB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FFE6E0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 54COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setFormats@QTextLayout@@QAEXABV?$QVector@UFormatRange@QTextLayout@@@@@Z.QT5GUI(?), ref: 04FFE73C
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Text$?setFormatFormats@Layout@@Layout@@@@@Range@Vector@
                                                                                                                                                                                                                        • String ID: BJ1$QTextLayout$setFormats$setFormats(self, overrides: Iterable[QTextLayout.FormatRange])
                                                                                                                                                                                                                        • API String ID: 2978315198-3499376178
                                                                                                                                                                                                                        • Opcode ID: 6c40bc14344a657f859fa94c7a92b20072da4d3fc321038b5466ed6fe55ef9b8
                                                                                                                                                                                                                        • Instruction ID: 023c916ad5ef1b14264861b165bb9612826e8572d87265a93b76cb9db9fa726e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6c40bc14344a657f859fa94c7a92b20072da4d3fc321038b5466ed6fe55ef9b8
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 28119030218201AFE701DFA8DC82E6A7BE5FB88310F540858F959D7270DB35E966DB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05024790 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 54COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setCreator@QPdfWriter@@QAEXABVQString@@@Z.QT5GUI(?), ref: 050247EC
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?setCreator@String@@@Writer@@
                                                                                                                                                                                                                        • String ID: BJ1$QPdfWriter$setCreator$setCreator(self, creator: Optional[str])
                                                                                                                                                                                                                        • API String ID: 55811658-2100157277
                                                                                                                                                                                                                        • Opcode ID: f9d6a2c6dad1085f3eaa912b33683d32a36c8a61c5b23b8d52c1da232a8fa8ed
                                                                                                                                                                                                                        • Instruction ID: f33ab272f3870ef9d89104bddad7f3d5024a72220066de1beb0eeca5afa8db31
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f9d6a2c6dad1085f3eaa912b33683d32a36c8a61c5b23b8d52c1da232a8fa8ed
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 96114270214201AFEB01DF98DC82E6A7BE5FB88310F544868F958D73B1DB75E996DB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050087E0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 54COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setDiscardCommand@QSessionManager@@QAEXABVQStringList@@@Z.QT5GUI(?), ref: 0500883C
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?setCommand@DiscardList@@@Manager@@SessionString
                                                                                                                                                                                                                        • String ID: BJ1$QSessionManager$setDiscardCommand$setDiscardCommand(self, a0: Iterable[Optional[str]])
                                                                                                                                                                                                                        • API String ID: 709668538-2485378439
                                                                                                                                                                                                                        • Opcode ID: 983d72afd6f06f7899bfb74af41b1b50c346cd2b16b28d1267680e9111dd83df
                                                                                                                                                                                                                        • Instruction ID: 15cacb7981a0254fcbe59f078c8b06e3a08761522499041670a41dd48a7782d0
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 983d72afd6f06f7899bfb74af41b1b50c346cd2b16b28d1267680e9111dd83df
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A0115E70118201AFE701DFA8DC82E6A7BF5FB88314F544868F959C72A0DB75E996DB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FFE610 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 54COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setItemRoleNames@QStandardItemModel@@QAEXABV?$QHash@HVQByteArray@@@@@Z.QT5GUI(?), ref: 04FFE66C
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • QStandardItemModel, xrefs: 04FFE6B9
                                                                                                                                                                                                                        • BJ1, xrefs: 04FFE642
                                                                                                                                                                                                                        • setItemRoleNames, xrefs: 04FFE6B4
                                                                                                                                                                                                                        • setItemRoleNames(self, roleNames: Dict[int, Union[QByteArray, bytes, bytearray]]), xrefs: 04FFE6AF
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Item$?setArray@@@@@ByteHash@Model@@Names@RoleStandard
                                                                                                                                                                                                                        • String ID: BJ1$QStandardItemModel$setItemRoleNames$setItemRoleNames(self, roleNames: Dict[int, Union[QByteArray, bytes, bytearray]])
                                                                                                                                                                                                                        • API String ID: 2491482276-4106150772
                                                                                                                                                                                                                        • Opcode ID: 16b47bb2f4ac9b442fd0544e8ce253007bff2ff69c145ee1057635fd5829299d
                                                                                                                                                                                                                        • Instruction ID: 2dcced2a8c680e7b579f82f3c7e8df0ccdfe77aa99e15b57ccc97acfcca9e7db
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 16b47bb2f4ac9b442fd0544e8ce253007bff2ff69c145ee1057635fd5829299d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5F118630218201AFD701DF64DC85E697BE5FB88310F504858F958C72B1D775ED96DB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05006610 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 54COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setFileName@QPictureIO@@QAEXABVQString@@@Z.QT5GUI(?), ref: 0500666C
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?setFileName@PictureString@@@
                                                                                                                                                                                                                        • String ID: BJ1$QPictureIO$setFileName$setFileName(self, a0: Optional[str])
                                                                                                                                                                                                                        • API String ID: 3214566917-123792022
                                                                                                                                                                                                                        • Opcode ID: e848134793cf7ae048a72303fb5a33ec0ab3d8bce56ce7f165e741b2508cbca0
                                                                                                                                                                                                                        • Instruction ID: 51d9e419b1283220461c389f11bc630feaf1202751476b66482651d5f87ed0e6
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e848134793cf7ae048a72303fb5a33ec0ab3d8bce56ce7f165e741b2508cbca0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C4116370118201AFE741DF94DC82E6A7BE5FB88300F504854F958D72A0DB76E956DB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0505E6B0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 54COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?prepend@?$QVector@VQPointF@@@@QAEXABVQPointF@@@Z.QT5CORE(?), ref: 0505E70C
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Point$?prepend@?$F@@@F@@@@Vector@
                                                                                                                                                                                                                        • String ID: BJ1$QPolygonF$prepend$prepend(self, value: Union[QPointF, QPoint])
                                                                                                                                                                                                                        • API String ID: 2483063175-411608185
                                                                                                                                                                                                                        • Opcode ID: 854e0c1d59553ec9c2a8ce67a6604d52762374041743a215062e8f21624e5916
                                                                                                                                                                                                                        • Instruction ID: baea33e0ab15a8daf3c002a7ae13a05b21b7b19f87650f7d999ff48731c447eb
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 854e0c1d59553ec9c2a8ce67a6604d52762374041743a215062e8f21624e5916
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B8119830154201AFD701EFA8DD81E6A7BE5FB88314F544858F958C33A0DB75ED56DB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05086430 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 52clipboardCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setImage@QClipboard@@QAEXABVQImage@@W4Mode@1@@Z.QT5GUI(?), ref: 050864A0
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • QClipboard, xrefs: 050864D3
                                                                                                                                                                                                                        • BJ9|E, xrefs: 05086468
                                                                                                                                                                                                                        • setImage(self, a0: QImage, mode: QClipboard.Mode = QClipboard.Clipboard), xrefs: 050864C9
                                                                                                                                                                                                                        • setImage, xrefs: 050864CE
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?setClipboard@@Image@Image@@Mode@1@@
                                                                                                                                                                                                                        • String ID: BJ9|E$QClipboard$setImage$setImage(self, a0: QImage, mode: QClipboard.Mode = QClipboard.Clipboard)
                                                                                                                                                                                                                        • API String ID: 763475505-3713900264
                                                                                                                                                                                                                        • Opcode ID: 28ad75f62382230dd05f606cf2f56a38c1a163f4fa3ca6d61ae22dac5f3e6a72
                                                                                                                                                                                                                        • Instruction ID: ea3e73047ff68afabf983704606d92b960a84257e4bc4bbc02efbf6897ce98c1
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 28ad75f62382230dd05f606cf2f56a38c1a163f4fa3ca6d61ae22dac5f3e6a72
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A4118F70254301AFE701DF54DC46E6A7BE9FB88700F544C68F954D33A1DB76A856DB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05054440 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 50COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyFloat_FromDouble.PYTHON3 ref: 050544C2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: DoubleFloat_From
                                                                                                                                                                                                                        • String ID: J9J9$QQuaternion$dotProduct$dotProduct(q1: QQuaternion, q2: QQuaternion) -> float
                                                                                                                                                                                                                        • API String ID: 329246742-4085906495
                                                                                                                                                                                                                        • Opcode ID: 840647e03473be4a6cf0d1ce9b913a241c81144d88741d15c9fb42bd24809338
                                                                                                                                                                                                                        • Instruction ID: 2395954e8031244d469c0ccbaff2f19667f01329b0025541b77164769bb5d6a7
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 840647e03473be4a6cf0d1ce9b913a241c81144d88741d15c9fb42bd24809338
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9011BF304142099FC302DF39D882A59BBE0BF48300F08CB55F848AB2A2E775B999DB01
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0502E610 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 50windowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?brush@QPalette@@QBEABVQBrush@@W4ColorGroup@1@W4ColorRole@1@@Z.QT5GUI(00000004,0000000B), ref: 0502E661
                                                                                                                                                                                                                        • ??0QBrush@@QAE@ABV0@@Z.QT5GUI(00000000), ref: 0502E66A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Brush@@Color$?brush@Group@1@Palette@@Role@1@@V0@@malloc
                                                                                                                                                                                                                        • String ID: QPalette$shadow$shadow(self) -> QBrush
                                                                                                                                                                                                                        • API String ID: 868068763-1173679860
                                                                                                                                                                                                                        • Opcode ID: 66879ad23658525685e1cfb586d9708128b8bf11ed6ec2f67a09b2ddb514f40c
                                                                                                                                                                                                                        • Instruction ID: 8ba06d6b5422d20d483cdeaff7c4bfe26800767b6022ada699de16459dede8d8
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 66879ad23658525685e1cfb586d9708128b8bf11ed6ec2f67a09b2ddb514f40c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7701F970244201BFEA11EBA4EC46FAE3BE8FB84710F440460FA08D7290D774ED99CB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0509C440 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?write@QOpenGLBuffer@@QAEXHPBXH@Z.QT5GUI(?,?,?), ref: 0509C49B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • QOpenGLBuffer, xrefs: 0509C4CE
                                                                                                                                                                                                                        • write(self, offset: int, data: Optional[PyQt5.sip.voidptr], count: int), xrefs: 0509C4C4
                                                                                                                                                                                                                        • write, xrefs: 0509C4C9
                                                                                                                                                                                                                        • Bivi, xrefs: 0509C469
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?write@Buffer@@Open
                                                                                                                                                                                                                        • String ID: Bivi$QOpenGLBuffer$write$write(self, offset: int, data: Optional[PyQt5.sip.voidptr], count: int)
                                                                                                                                                                                                                        • API String ID: 3632925671-3393065662
                                                                                                                                                                                                                        • Opcode ID: 1ddab77d6d2f9df573161bd13f853a7e4e63536f582143ed08550424f8052f54
                                                                                                                                                                                                                        • Instruction ID: 134171daac82a9e801272faa60526415fe943d2de38bad897d626c65fe5e6d0c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1ddab77d6d2f9df573161bd13f853a7e4e63536f582143ed08550424f8052f54
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7A11A075208201AFD701DF94DC81DABB7E9FB88700F404469F959D3260DB35ED5ADB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FEC6A0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?changePersistentIndex@QAbstractItemModel@@IAEXABVQModelIndex@@0@Z.QT5CORE(?,?), ref: 04FEC6F9
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • changePersistentIndex, xrefs: 04FEC727
                                                                                                                                                                                                                        • changePersistentIndex(self, from_: QModelIndex, to: QModelIndex), xrefs: 04FEC722
                                                                                                                                                                                                                        • QStandardItemModel, xrefs: 04FEC72C
                                                                                                                                                                                                                        • BJ9J9, xrefs: 04FEC6CB
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?changeAbstractIndex@Index@@0@ItemModelModel@@Persistent
                                                                                                                                                                                                                        • String ID: BJ9J9$QStandardItemModel$changePersistentIndex$changePersistentIndex(self, from_: QModelIndex, to: QModelIndex)
                                                                                                                                                                                                                        • API String ID: 794346470-2745956623
                                                                                                                                                                                                                        • Opcode ID: aded432e43af2b4bb685a7480cf61ee2615d76097584c14b47d5b5731e75bba8
                                                                                                                                                                                                                        • Instruction ID: 1d160b129c6428e7b72a45b3bd440c61ab076bc88d00a5ef73b58e4eb43fe11f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: aded432e43af2b4bb685a7480cf61ee2615d76097584c14b47d5b5731e75bba8
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 98118E30254201AFD701DF64DC82D6A7BE9FB88310F544859F968D32A0EB75ED56DB01
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FF8430 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 47COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?mapToPolygon@QTransform@@QBE?AVQPolygon@@ABVQRect@@@Z.QT5GUI(00000000,?), ref: 04FF848A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?mapPolygon@Polygon@@Rect@@@Transform@@malloc
                                                                                                                                                                                                                        • String ID: BJ9$QTransform$mapToPolygon$mapToPolygon(self, r: QRect) -> QPolygon
                                                                                                                                                                                                                        • API String ID: 4134932626-3969976114
                                                                                                                                                                                                                        • Opcode ID: 296618d857595c0be4373d9c688743c6f1357532f9a1e018f2729ad424c8e19f
                                                                                                                                                                                                                        • Instruction ID: 308ee395f5f0a293efd27fac8a076b27ecc99877b4db10af6f5066f5813fc3b6
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 296618d857595c0be4373d9c688743c6f1357532f9a1e018f2729ad424c8e19f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4E019270654202AFEB01DFA4EC42F6A7BE9BB88300F444464FA58C7250D775EA9ADB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05038640 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 47COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?createStroke@QPainterPathStroker@@QBE?AVQPainterPath@@ABV2@@Z.QT5GUI(00000000,?), ref: 0503869A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Painter$?createPathPath@@Stroke@Stroker@@V2@@malloc
                                                                                                                                                                                                                        • String ID: BJ9$QPainterPathStroker$createStroke$createStroke(self, path: QPainterPath) -> QPainterPath
                                                                                                                                                                                                                        • API String ID: 1521205396-500091838
                                                                                                                                                                                                                        • Opcode ID: 31bf72cbe41eddde84292e98ae022ee3d092f1184395661e1e9175ce4dabb2cb
                                                                                                                                                                                                                        • Instruction ID: 6739ba1ee4e2782a74960cf65bae8ed3153a9966bbaa8eb73de8f7fe644fc10b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 31bf72cbe41eddde84292e98ae022ee3d092f1184395661e1e9175ce4dabb2cb
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A501D670254201BFD701DBA4EC42F6E7BE9FB88304F444424FA58C3250D779EA59DB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05012440 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 46COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?insertColumns@QTextTable@@QAEXHH@Z.QT5GUI(?,?), ref: 05012492
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?insertColumns@Table@@Text
                                                                                                                                                                                                                        • String ID: Bii$QTextTable$insertColumns$insertColumns(self, pos: int, num: int)
                                                                                                                                                                                                                        • API String ID: 1320599217-1414679935
                                                                                                                                                                                                                        • Opcode ID: ccc64782850b2441af39caad7d71e06de37690f9c860b6260cc0f4f30760f8d9
                                                                                                                                                                                                                        • Instruction ID: c3899bfe065082a96456c7ae6c434d77e6d4105767d598334601e0900ef2aa97
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ccc64782850b2441af39caad7d71e06de37690f9c860b6260cc0f4f30760f8d9
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 39016134214201AFE701DF94DC82D6A77E9FB88310F544859F958D7260DB79ED56DB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0504E4D0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 46COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?removeRows@QStandardItem@@QAEXHH@Z.QT5GUI(?,?), ref: 0504E522
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?removeItem@@Rows@Standard
                                                                                                                                                                                                                        • String ID: Bii$QStandardItem$removeRows$removeRows(self, row: int, count: int)
                                                                                                                                                                                                                        • API String ID: 3935922224-2605227661
                                                                                                                                                                                                                        • Opcode ID: da13bca86f7ebd4bae7c23a0f1ea4236a78134a69877f61fcfc7ba87ffef64ab
                                                                                                                                                                                                                        • Instruction ID: 70ce661821d7bbab63b82907b441a14346774043a0ae34a84241fddaa5af04f4
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: da13bca86f7ebd4bae7c23a0f1ea4236a78134a69877f61fcfc7ba87ffef64ab
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F001A130204201AFD701DF94DC81E6E7BE9FB88310F540868F958C3290EB75DD46DB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05012700 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 46COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?removeRows@QTextTable@@QAEXHH@Z.QT5GUI(?,?), ref: 05012752
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?removeRows@Table@@Text
                                                                                                                                                                                                                        • String ID: Bii$QTextTable$removeRows$removeRows(self, pos: int, num: int)
                                                                                                                                                                                                                        • API String ID: 195637030-225513460
                                                                                                                                                                                                                        • Opcode ID: 3430bc3da0322847fcd5279449f2c63496cad27d4981be61534c29041875a45b
                                                                                                                                                                                                                        • Instruction ID: fafebdfee79f491e41fde57e75b3371cac8eb0e2b4ca774e19574cc17d8c6e89
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3430bc3da0322847fcd5279449f2c63496cad27d4981be61534c29041875a45b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1F01C435108201AFD701DF94DD82D6A7BE8FB88310F504869F958C3360EB75E946DB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0507A760 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 46COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setVersion@QOpenGLVersionProfile@@QAEXHH@Z.QT5GUI(?,?), ref: 0507A7B2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?setOpenProfile@@VersionVersion@
                                                                                                                                                                                                                        • String ID: Bii$QOpenGLVersionProfile$setVersion$setVersion(self, majorVersion: int, minorVersion: int)
                                                                                                                                                                                                                        • API String ID: 640118179-756091894
                                                                                                                                                                                                                        • Opcode ID: 99d7a76cdd328a50f6f79210306daacd66ab4ae9afc19e9d022c2e139cd99048
                                                                                                                                                                                                                        • Instruction ID: d0c01f13a2b3b22c66765ff8c600c8892de8e2a98dedc35c6b6d371be223b085
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 99d7a76cdd328a50f6f79210306daacd66ab4ae9afc19e9d022c2e139cd99048
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1A01AD30218201AFD701EFA4DD82D6ABBF9FB88300F444859F958D3260EB75ED56DB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05030590 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 45COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?swap@QRegion@@QAEXAAV1@@Z.QT5GUI(?), ref: 050305DA
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?swap@Region@@V1@@
                                                                                                                                                                                                                        • String ID: BJ9$QRawFont$swap$swap(self, other: QRawFont)
                                                                                                                                                                                                                        • API String ID: 2712419754-2130710366
                                                                                                                                                                                                                        • Opcode ID: 5c91c29c06904381662a7521ca6fce5a68d0d3fcafcdbb8982c7d12ace131dbe
                                                                                                                                                                                                                        • Instruction ID: ef94f99da4be4997a239616404311f59ff9c49cee16b23af5a9c8dd73177e388
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5c91c29c06904381662a7521ca6fce5a68d0d3fcafcdbb8982c7d12ace131dbe
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 70019274254202AFD740CFA4EC86E6A77E8FB48310F544528F959C3390DB78ED46DB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0503C410 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 45COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?swap@QRegion@@QAEXAAV1@@Z.QT5GUI(?), ref: 0503C45A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?swap@Region@@V1@@
                                                                                                                                                                                                                        • String ID: BJ9$QStaticText$swap$swap(self, other: QStaticText)
                                                                                                                                                                                                                        • API String ID: 2712419754-2718320023
                                                                                                                                                                                                                        • Opcode ID: 6bb7c0b44ae771eee56be08adaee54a61098c664e46deb4203d7f996409322da
                                                                                                                                                                                                                        • Instruction ID: eaf08f0479b3ce8f9c1167b57e6dd36f5f9b0c7f59f6a66987498bacbcdfda0f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6bb7c0b44ae771eee56be08adaee54a61098c664e46deb4203d7f996409322da
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C1018034214201AFE700DBA4EC82E6A77E8BB48310F544528FD59D3390DB78ED46DB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0507C440 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 44COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setStaticContents@QBackingStore@@QAEXABVQRegion@@@Z.QT5GUI(?), ref: 0507C48F
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?setBackingContents@Region@@@StaticStore@@
                                                                                                                                                                                                                        • String ID: BJ9$QBackingStore$setStaticContents$setStaticContents(self, region: QRegion)
                                                                                                                                                                                                                        • API String ID: 574211981-1198615974
                                                                                                                                                                                                                        • Opcode ID: d5c1fdb524054ca02f00e606dbcd422360e6b4584eb68d2ccd2a0f6841447dfd
                                                                                                                                                                                                                        • Instruction ID: d4fe6392faa2fa669139c69ea69cd4a968406006b62319cd77849ab21c6a20b1
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d5c1fdb524054ca02f00e606dbcd422360e6b4584eb68d2ccd2a0f6841447dfd
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 23016D34214205AFD701DBA4EC82E697BE5FB88700F544428FD58D3290DB79AD5ADB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0505E450 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 44COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setFormat@QTextObject@@IAEXABVQTextFormat@@@Z.QT5GUI(?), ref: 0505E49F
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Text$?setFormat@Format@@@Object@@
                                                                                                                                                                                                                        • String ID: BJ9$QTextList$setFormat$setFormat(self, aformat: QTextListFormat)
                                                                                                                                                                                                                        • API String ID: 760775155-2556661487
                                                                                                                                                                                                                        • Opcode ID: c9fe63ad8e8c7a921d86e324573c2db46bb030fee7d5c605924a6b72ce7c2309
                                                                                                                                                                                                                        • Instruction ID: 4370836871e2de36140bca85d09932a426ff1242a260c42241be39e297398de1
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c9fe63ad8e8c7a921d86e324573c2db46bb030fee7d5c605924a6b72ce7c2309
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A4016D30204202AFD701DB64EC82E6A7BE9FB88710F544568FC59C3390EB79EA56DB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05006460 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 44COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?mergeBlockCharFormat@QTextCursor@@QAEXABVQTextCharFormat@@@Z.QT5GUI(?), ref: 050064AF
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CharText$?mergeBlockCursor@@Format@Format@@@
                                                                                                                                                                                                                        • String ID: BJ9$QTextCursor$mergeBlockCharFormat$mergeBlockCharFormat(self, modifier: QTextCharFormat)
                                                                                                                                                                                                                        • API String ID: 3144875899-869572982
                                                                                                                                                                                                                        • Opcode ID: bf55ee6080ddb946ab149935e9c574e641dc0588c0a8fa313197d7ea88371ad4
                                                                                                                                                                                                                        • Instruction ID: 3d0150321cf2713fe50fd7e04407012f3fc570ddce5472feaa02fcdb5b4dff82
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: bf55ee6080ddb946ab149935e9c574e641dc0588c0a8fa313197d7ea88371ad4
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 51018030204201AFE701DF54EC82E6A7BEAFB48310F544828FD59D7390DB799D5ADB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050084C0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 44COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setMinimumSize@QWindow@@QAEXABVQSize@@@Z.QT5GUI(?), ref: 0500850F
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?setMinimumSize@Size@@@Window@@
                                                                                                                                                                                                                        • String ID: BJ9$QWindow$setMinimumSize$setMinimumSize(self, size: QSize)
                                                                                                                                                                                                                        • API String ID: 1804966750-98341282
                                                                                                                                                                                                                        • Opcode ID: 85b5996e6ec08e858d84146cc0836a78c0a6068987b3b4d24aa0454c08b2ff20
                                                                                                                                                                                                                        • Instruction ID: 03e687fbda28369f2b9a2f33b59e474c271e738d489791c791e45445117e4620
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 85b5996e6ec08e858d84146cc0836a78c0a6068987b3b4d24aa0454c08b2ff20
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 22018030214205AFE701DF64EC46E697BE5FB88310F544468F958C73A0DB75AA5ADB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FF66F0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 44COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setFont@QTextLayout@@QAEXABVQFont@@@Z.QT5GUI(?), ref: 04FF673F
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?setFont@Font@@@Layout@@Text
                                                                                                                                                                                                                        • String ID: BJ9$QTextLayout$setFont$setFont(self, f: QFont)
                                                                                                                                                                                                                        • API String ID: 3936302281-1305214941
                                                                                                                                                                                                                        • Opcode ID: 8c971903be16733fd04bfc47d480d7746f460bc5d77dfbc54a72e5f6a6a74b7d
                                                                                                                                                                                                                        • Instruction ID: 737f31e82c6098daf7828bdabfba6e88f69526dbc82c55835d3e548743070766
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8c971903be16733fd04bfc47d480d7746f460bc5d77dfbc54a72e5f6a6a74b7d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3E018030214202AFE701DF94EC82E697BE9FB48714F544829FD58D73A0DB75AD56DB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FE26E0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 44COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setMinimumMargins@QPageLayout@@QAEXABVQMarginsF@@@Z.QT5GUI(?), ref: 04FE272F
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?setF@@@Layout@@MarginsMargins@MinimumPage
                                                                                                                                                                                                                        • String ID: BJ9$QPageLayout$setMinimumMargins$setMinimumMargins(self, minMargins: QMarginsF)
                                                                                                                                                                                                                        • API String ID: 1989108899-2252448879
                                                                                                                                                                                                                        • Opcode ID: 54b2a9b4824e7d8e9f5fcd7958d6a13a16c9b248b25a27ea0abfba74f37907ca
                                                                                                                                                                                                                        • Instruction ID: 38534d75f52ecfd75d7f2e36b9da84283f43f16223193e968af0934c56238fdd
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 54b2a9b4824e7d8e9f5fcd7958d6a13a16c9b248b25a27ea0abfba74f37907ca
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5C016130214201AFD701CB54EC42E6A7BE5FB88314F544468FC58D7260E775A956DB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05050730 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 44windowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setIcon@QStandardItem@@QAEXABVQIcon@@@Z.QT5GUI(?), ref: 0505077F
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?setIcon@Icon@@@Item@@Standard
                                                                                                                                                                                                                        • String ID: BJ9$QStandardItem$setIcon$setIcon(self, aicon: QIcon)
                                                                                                                                                                                                                        • API String ID: 1659873823-3240692480
                                                                                                                                                                                                                        • Opcode ID: 6783e2ebdaeeed1ba077b59d7495f364efea6097246628161dd57b7861a627e1
                                                                                                                                                                                                                        • Instruction ID: 6d5a9f20dc0e082065512406e498795e9f739d7636f6d4baf5dc0cd4b222760b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6783e2ebdaeeed1ba077b59d7495f364efea6097246628161dd57b7861a627e1
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7B018430214205AFD701CF64ED86E6E7BE5FB88710F544828FD58C3390DB79995ADB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FF46C0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 44COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?print@QTextDocument@@QBEXPAVQPagedPaintDevice@@@Z.QT5GUI(?), ref: 04FF470F
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?print@Device@@@Document@@PagedPaintText
                                                                                                                                                                                                                        • String ID: BJ8$QTextDocument$print$print(self, printer: Optional[QPagedPaintDevice])
                                                                                                                                                                                                                        • API String ID: 3247112876-1109709291
                                                                                                                                                                                                                        • Opcode ID: 94eafd2192b51dd8c1fb67adaa2f1ee4f2943e4988ffc65e4b059732925a9d28
                                                                                                                                                                                                                        • Instruction ID: dc8741533c340ff1fa497a7759086d1b570317a4222d9a7d1e7473350e64d104
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 94eafd2192b51dd8c1fb67adaa2f1ee4f2943e4988ffc65e4b059732925a9d28
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 10019270204205AFD701CF64EC82E6A7BF5FB88710F540428F958D73A0DB79E95ADB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05054790 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 44COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setRegExp@QRegExpValidator@@QAEXABVQRegExp@@@Z.QT5GUI(?), ref: 050547DF
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?setExp@Exp@@@Validator@@
                                                                                                                                                                                                                        • String ID: BJ9$QRegExpValidator$setRegExp$setRegExp(self, rx: QRegExp)
                                                                                                                                                                                                                        • API String ID: 3356541571-3763716425
                                                                                                                                                                                                                        • Opcode ID: 307c9c02a09eae1d15d5b9be2b7ed524b175fef16ffe93a1c7f47a933fcb9a46
                                                                                                                                                                                                                        • Instruction ID: 328c91987193a398910b582d839b2c58610a560dc95edae3997a51fb676f0f4c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 307c9c02a09eae1d15d5b9be2b7ed524b175fef16ffe93a1c7f47a933fcb9a46
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2101C030214201AFDB01CFA4EC82D7A7BE9FB88310F504428FD58C3390EB799A5ADB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050027F0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 44COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setFormat@QWindow@@QAEXABVQSurfaceFormat@@@Z.QT5GUI(?), ref: 0500283F
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?setFormat@Format@@@SurfaceWindow@@
                                                                                                                                                                                                                        • String ID: BJ9$QWindow$setFormat$setFormat(self, format: QSurfaceFormat)
                                                                                                                                                                                                                        • API String ID: 531212981-690706673
                                                                                                                                                                                                                        • Opcode ID: a242cdda1ebd6b3a160534f7fa3929ec8a6301dfe73c287a6a73a7154a97c8fb
                                                                                                                                                                                                                        • Instruction ID: 27285562dbeb657dbff99ba1afac221b089c9443ff15d5b98b7401c748cc7f50
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a242cdda1ebd6b3a160534f7fa3929ec8a6301dfe73c287a6a73a7154a97c8fb
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D9019234214202AFE701DF94EC86E697BE9FB88710F544468FD58C73A0DB79AD5ADB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0504C620 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 44COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setFormat@QTextObject@@IAEXABVQTextFormat@@@Z.QT5GUI(?), ref: 0504C66F
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Text$?setFormat@Format@@@Object@@
                                                                                                                                                                                                                        • String ID: BJ9$QTextFrame$setFormat$setFormat(self, format: QTextFormat)
                                                                                                                                                                                                                        • API String ID: 760775155-2643208564
                                                                                                                                                                                                                        • Opcode ID: 43cf7cf9c81b845930d3a65960f78a1854a8b2a2c4c9e9d561a5c7a98ce5eead
                                                                                                                                                                                                                        • Instruction ID: 0a4d236f73dcfc4f9e970462988f2362a7943dca48a60c9ba161d94eaa4eb870
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 43cf7cf9c81b845930d3a65960f78a1854a8b2a2c4c9e9d561a5c7a98ce5eead
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 04016170214201AFD701DB64EC42E697BE9BB48700F544528FD58D72A0DB75995ADB01
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050404B0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 41COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?doubleProperty@QTextFormat@@QBENH@Z.QT5GUI(?), ref: 050404F9
                                                                                                                                                                                                                        • PyFloat_FromDouble.PYTHON3 ref: 05040511
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • doubleProperty(self, propertyId: int) -> float, xrefs: 05040523
                                                                                                                                                                                                                        • QTextFormat, xrefs: 0504052D
                                                                                                                                                                                                                        • doubleProperty, xrefs: 05040528
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?doubleDoubleFloat_Format@@FromProperty@Text
                                                                                                                                                                                                                        • String ID: QTextFormat$doubleProperty$doubleProperty(self, propertyId: int) -> float
                                                                                                                                                                                                                        • API String ID: 2584946227-2925036496
                                                                                                                                                                                                                        • Opcode ID: f7535f46c47a8417694118b786b213434efcc10e3b6efce2137aa5423fbef615
                                                                                                                                                                                                                        • Instruction ID: d14895a13060b8a8e951513307a24cebd01420fcf09e33e999c19e8367b2f22c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f7535f46c47a8417694118b786b213434efcc10e3b6efce2137aa5423fbef615
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6501B170518205AFC701EF68DD42E5F7BE8FF84701F444868F889A6211EB74D998DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050107A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 40COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?isLandscape@QScreen@@QBE_NW4ScreenOrientation@Qt@@@Z.QT5GUI(?), ref: 050107EF
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 050107F9
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • isLandscape(self, orientation: Qt.ScreenOrientation) -> bool, xrefs: 0501080B
                                                                                                                                                                                                                        • isLandscape, xrefs: 05010810
                                                                                                                                                                                                                        • QScreen, xrefs: 05010815
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Bool_FromLandscape@LongOrientation@Qt@@@ScreenScreen@@
                                                                                                                                                                                                                        • String ID: QScreen$isLandscape$isLandscape(self, orientation: Qt.ScreenOrientation) -> bool
                                                                                                                                                                                                                        • API String ID: 2881211027-3315176112
                                                                                                                                                                                                                        • Opcode ID: 676ef6951689553978dcd10972d0064476b30324c08d18ed5c22ab0e79d92489
                                                                                                                                                                                                                        • Instruction ID: d0e3f595fba9672bb8c3e7e80808e4db02ae584c9779bf2b6dd6f61e61dcbf0a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 676ef6951689553978dcd10972d0064476b30324c08d18ed5c22ab0e79d92489
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6D018470108205AFD701DF90EC46E7E7BE9FB88604F444425FD98C2250D779EA599B42
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040598B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Fatal error: unable to decode the command line argument #%i, xrefs: 004059EB
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: free$DecodeLocalesetlocale
                                                                                                                                                                                                                        • String ID: Fatal error: unable to decode the command line argument #%i
                                                                                                                                                                                                                        • API String ID: 2577174431-810459673
                                                                                                                                                                                                                        • Opcode ID: 9d1a7e72fccc39349e8435cb77fec3904dd9347efbe4d5a34812376667be7cae
                                                                                                                                                                                                                        • Instruction ID: f47e09dd697b96e2b59eaf830e36c8aa388eac640d0f1e900355e8c5eb1699ce
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9d1a7e72fccc39349e8435cb77fec3904dd9347efbe4d5a34812376667be7cae
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 86011DB5A047018FDB10AF69E88526ABBE0EF05314F46093EE9C4A7341D33DE8858B99
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05004510 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 39COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?doubleProperty@QTextFormat@@QBENH@Z.QT5GUI(00004814), ref: 05004555
                                                                                                                                                                                                                        • PyFloat_FromDouble.PYTHON3 ref: 0500456D
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?doubleDoubleFloat_Format@@FromProperty@Text
                                                                                                                                                                                                                        • String ID: QTextTableCellFormat$leftPadding$leftPadding(self) -> float
                                                                                                                                                                                                                        • API String ID: 2584946227-4066119610
                                                                                                                                                                                                                        • Opcode ID: e1910161260683cfea2088c807c718038b4047b2719a526e95a4682c4090ed0c
                                                                                                                                                                                                                        • Instruction ID: 9840e62a738162fda29a7ac796430793b14765fc7fae80ba6c33fbe9a7cf8522
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e1910161260683cfea2088c807c718038b4047b2719a526e95a4682c4090ed0c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C401F2705183019FD701FFA8DD42D2E7BF4FF84701F444868F98886251EB74E9599B62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0502A530 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 39COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?doubleProperty@QTextFormat@@QBENH@Z.QT5GUI(00002001), ref: 0502A575
                                                                                                                                                                                                                        • PyFloat_FromDouble.PYTHON3 ref: 0502A58D
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?doubleDoubleFloat_Format@@FromProperty@Text
                                                                                                                                                                                                                        • String ID: QTextCharFormat$fontPointSize$fontPointSize(self) -> float
                                                                                                                                                                                                                        • API String ID: 2584946227-1070637524
                                                                                                                                                                                                                        • Opcode ID: 1aeef95d9d5af748710c2f840ec7bda1273a1208bcc4b570067ff8715b28b05b
                                                                                                                                                                                                                        • Instruction ID: f3dca276c161a290d2686a5ae6b32b2ad2bc2f2dba7a9a1c0927b073be62ca78
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1aeef95d9d5af748710c2f840ec7bda1273a1208bcc4b570067ff8715b28b05b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D20126301583019FD701EFA8DD46E6EBBF4FF84301F444868F85896211EB74E999DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0501A5D0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 39COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?doubleProperty@QTextFormat@@QBENH@Z.QT5GUI(00005010), ref: 0501A615
                                                                                                                                                                                                                        • PyFloat_FromDouble.PYTHON3 ref: 0501A62D
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?doubleDoubleFloat_Format@@FromProperty@Text
                                                                                                                                                                                                                        • String ID: QTextImageFormat$width$width(self) -> float
                                                                                                                                                                                                                        • API String ID: 2584946227-3353682923
                                                                                                                                                                                                                        • Opcode ID: 3d5e61a8b1fcfd072993323dc055dd510162fd0cdfe117d2df87ba78c11dd88f
                                                                                                                                                                                                                        • Instruction ID: 9687671633c2510bce52556de4898460d06c2ba05339b11e6c58f51e8085c9ab
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3d5e61a8b1fcfd072993323dc055dd510162fd0cdfe117d2df87ba78c11dd88f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1201DF30558701AFD701EFA8DC46D6E7BE4FB84301F840868FD8886250EB75999D9B53
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05022450 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 39COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?doubleProperty@QTextFormat@@QBENH@Z.QT5GUI(00001032), ref: 05022495
                                                                                                                                                                                                                        • PyFloat_FromDouble.PYTHON3 ref: 050224AD
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?doubleDoubleFloat_Format@@FromProperty@Text
                                                                                                                                                                                                                        • String ID: QTextBlockFormat$leftMargin$leftMargin(self) -> float
                                                                                                                                                                                                                        • API String ID: 2584946227-3194882735
                                                                                                                                                                                                                        • Opcode ID: 3933ccff7941769668484c14252fe031037c095347dc927e540247c50b9e924f
                                                                                                                                                                                                                        • Instruction ID: 6f1265107ab91ca1767b4efab1e2c61c5cbea5f8096bad6de019cf3803881668
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3933ccff7941769668484c14252fe031037c095347dc927e540247c50b9e924f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F8012630558301AFD701EFA8DC42D6E7BF8FF84301F444858F89886250EB78D9999B53
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0501A7B0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 39COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?doubleProperty@QTextFormat@@QBENH@Z.QT5GUI(00005011), ref: 0501A7F5
                                                                                                                                                                                                                        • PyFloat_FromDouble.PYTHON3 ref: 0501A80D
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?doubleDoubleFloat_Format@@FromProperty@Text
                                                                                                                                                                                                                        • String ID: QTextImageFormat$height$height(self) -> float
                                                                                                                                                                                                                        • API String ID: 2584946227-3151405701
                                                                                                                                                                                                                        • Opcode ID: 8dc87fd8101fd3988f487effa0014bad09e5768020044cf9ba9998397dde8800
                                                                                                                                                                                                                        • Instruction ID: 72d60e1831e780b5967e2daa4692cd68c9a34f6aabbab48fff59f286b5bdd6ba
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8dc87fd8101fd3988f487effa0014bad09e5768020044cf9ba9998397dde8800
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1201DF30518701AFD700EFA8DC02D6EBBE4FB84301F844868FC5886211EB74A99ADB53
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0500E7F0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 39COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?doubleProperty@QTextFormat@@QBENH@Z.QT5GUI(00004103), ref: 0500E835
                                                                                                                                                                                                                        • PyFloat_FromDouble.PYTHON3 ref: 0500E84D
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?doubleDoubleFloat_Format@@FromProperty@Text
                                                                                                                                                                                                                        • String ID: QTextTableFormat$cellPadding$cellPadding(self) -> float
                                                                                                                                                                                                                        • API String ID: 2584946227-1600723810
                                                                                                                                                                                                                        • Opcode ID: 5d4df38bb3783a6b3f268b4d68239610b64ee480d88bb5e2eda1c07f2c5850ba
                                                                                                                                                                                                                        • Instruction ID: 4ac9192efa6b00fca55b8c5442337dd69b76b35d1ec7cfce564ba831bb684458
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5d4df38bb3783a6b3f268b4d68239610b64ee480d88bb5e2eda1c07f2c5850ba
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E301F270518301AFE701EFA8DD46D6E7BF4FB84301F8448A8F99896250EB74A9999B12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05028530 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?type@QTextFormat@@QBEHXZ.QT5GUI ref: 05028570
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(00000000), ref: 0502857F
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?type@Bool_Format@@FromLongText
                                                                                                                                                                                                                        • String ID: QTextCharFormat$isValid$isValid(self) -> bool
                                                                                                                                                                                                                        • API String ID: 1807932774-2203707715
                                                                                                                                                                                                                        • Opcode ID: 572e1a968d46bc1fd3f94ba042dc518ddcd5d3dbeaa4e2f397bec7e8ee84a86d
                                                                                                                                                                                                                        • Instruction ID: a7a431e2c125c64467063e8dd13c9a8a6a82323342a25c65d1525d1c197ace59
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 572e1a968d46bc1fd3f94ba042dc518ddcd5d3dbeaa4e2f397bec7e8ee84a86d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 04F0D170114201AFDB00EF60ED46E6E3BE8FB84601F480428F848C7210E6B9EE58DB53
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0502C5C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?ascent@QRawFont@@QBENXZ.QT5GUI ref: 0502C600
                                                                                                                                                                                                                        • PyFloat_FromDouble.PYTHON3 ref: 0502C618
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?ascent@DoubleFloat_Font@@From
                                                                                                                                                                                                                        • String ID: QRawFont$ascent$ascent(self) -> float
                                                                                                                                                                                                                        • API String ID: 309496825-1630061228
                                                                                                                                                                                                                        • Opcode ID: 716f0c1b260750784bc4b432488a92e346f0d95db9a45e412e6d15ea1c5ab9e6
                                                                                                                                                                                                                        • Instruction ID: 7a4ff31fa135487c715037fa7bcea346c9c81ad0cbf1f71fee2fde23255a889d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 716f0c1b260750784bc4b432488a92e346f0d95db9a45e412e6d15ea1c5ab9e6
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8001D170558302AFD701EF68ED46D6EBBF4FF84301F844868F89886221EB74A9599B52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05046420 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?length@QPainterPath@@QBENXZ.QT5GUI ref: 05046460
                                                                                                                                                                                                                        • PyFloat_FromDouble.PYTHON3 ref: 05046478
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?length@DoubleFloat_FromPainterPath@@
                                                                                                                                                                                                                        • String ID: QPainterPath$length$length(self) -> float
                                                                                                                                                                                                                        • API String ID: 4101591971-966799709
                                                                                                                                                                                                                        • Opcode ID: 2430c7fa9761bff957afc6ae543e9aa0949c3238088ae7b234bff299e45da2e7
                                                                                                                                                                                                                        • Instruction ID: 928d15c72fa2ac46e1a94d0cc6abce81ae08b1e7940a80f4c4aedcd5230b924d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2430c7fa9761bff957afc6ae543e9aa0949c3238088ae7b234bff299e45da2e7
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A201D6705543019FD701FFA8DD42D6EBBF4FF84301F444868F85886211EB75A9599B52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05016430 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?miterLimit@QPen@@QBENXZ.QT5GUI ref: 05016470
                                                                                                                                                                                                                        • PyFloat_FromDouble.PYTHON3 ref: 05016488
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?miterDoubleFloat_FromLimit@Pen@@
                                                                                                                                                                                                                        • String ID: QPen$miterLimit$miterLimit(self) -> float
                                                                                                                                                                                                                        • API String ID: 1439586523-1728842678
                                                                                                                                                                                                                        • Opcode ID: ec379798dd93be71a03a97fe3b60a836ae4a3641dd14f347711cd4abca39e7de
                                                                                                                                                                                                                        • Instruction ID: 8d4bfba42835783e53f9b30dd631c4d9a91770bf4e4e918fd04b6750048b72eb
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ec379798dd93be71a03a97fe3b60a836ae4a3641dd14f347711cd4abca39e7de
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E501D6305543019FD701EF68DD46D6E7BF8FF88301F444864FC9886211EB75E959AB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05042430 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?type@QTextFormat@@QBEHXZ.QT5GUI ref: 05042470
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(00000000), ref: 0504247F
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?type@Bool_Format@@FromLongText
                                                                                                                                                                                                                        • String ID: QTextFormat$isCharFormat$isCharFormat(self) -> bool
                                                                                                                                                                                                                        • API String ID: 1807932774-3803817776
                                                                                                                                                                                                                        • Opcode ID: f2795bf23da851ba5ac6c95bf036001d6e661bdebbd8dacf7a3c334fbfa4afc0
                                                                                                                                                                                                                        • Instruction ID: 9a62fd7c3d541e828c45da37ca861fe36263faebc745050b36150bf5bb14f480
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f2795bf23da851ba5ac6c95bf036001d6e661bdebbd8dacf7a3c334fbfa4afc0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 56F0D674154201AFDB00EBA0ED46D5E3BE4FB84701F440434F848D6250DAB5EE59DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05042770 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?type@QTextFormat@@QBEHXZ.QT5GUI ref: 050427B0
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(00000000), ref: 050427BF
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?type@Bool_Format@@FromLongText
                                                                                                                                                                                                                        • String ID: QTextFormat$isBlockFormat$isBlockFormat(self) -> bool
                                                                                                                                                                                                                        • API String ID: 1807932774-2730531752
                                                                                                                                                                                                                        • Opcode ID: c877d71aacd1b8c20bbb096a79c6f78c2252dbb2299217f4c177bf56aadf80ab
                                                                                                                                                                                                                        • Instruction ID: 87722882c477cfa4a6ec72269bbaebd60cbe292885799b533c417db966d6a17f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c877d71aacd1b8c20bbb096a79c6f78c2252dbb2299217f4c177bf56aadf80ab
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 37F0D174214201AFDA00EB60ED06D5E3BE8FB88701F440838F848D7250EAB9EE59DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050187E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?opacity@QWindow@@QBENXZ.QT5GUI ref: 05018820
                                                                                                                                                                                                                        • PyFloat_FromDouble.PYTHON3 ref: 05018838
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?opacity@DoubleFloat_FromWindow@@
                                                                                                                                                                                                                        • String ID: QWindow$opacity$opacity(self) -> float
                                                                                                                                                                                                                        • API String ID: 2814542115-2832915144
                                                                                                                                                                                                                        • Opcode ID: a8084454bc24ba0d3693cbf43e536c52a4e33628eb07ca5efa84e7bfd2eb5da3
                                                                                                                                                                                                                        • Instruction ID: 83432f7eb9485a58b7c8404c16680526ed1d81c51efc02246d549ede9ac75969
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a8084454bc24ba0d3693cbf43e536c52a4e33628eb07ca5efa84e7bfd2eb5da3
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3901D1305587029FD701EF68DC06E6E7BF8FF84301F844868FD9896220EB75A9599B52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0509A600 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?xHeight@QFontMetricsF@@QBENXZ.QT5GUI ref: 0509A640
                                                                                                                                                                                                                        • PyFloat_FromDouble.PYTHON3 ref: 0509A658
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: DoubleFloat_FontFromHeight@Metrics
                                                                                                                                                                                                                        • String ID: QFontMetricsF$xHeight$xHeight(self) -> float
                                                                                                                                                                                                                        • API String ID: 3568500478-3297979623
                                                                                                                                                                                                                        • Opcode ID: 999a6401c1164ca8ece7cb834f589b3408af5fab57d7625a90724492d53e4052
                                                                                                                                                                                                                        • Instruction ID: 09b89236bcbe2fdd5de291a5e49ff5a59ae439a2b6c17a8c5d18cdfb3c3ccfd0
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 999a6401c1164ca8ece7cb834f589b3408af5fab57d7625a90724492d53e4052
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3E0126305183019FD700EF68DD42D6E7BF4FF44702F800868F88886620EB75A958DB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05090680 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?determinant@QMatrix4x4@@QBENXZ.QT5GUI ref: 050906C0
                                                                                                                                                                                                                        • PyFloat_FromDouble.PYTHON3 ref: 050906D8
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?determinant@DoubleFloat_FromMatrix4x4@@
                                                                                                                                                                                                                        • String ID: QMatrix4x4$determinant$determinant(self) -> float
                                                                                                                                                                                                                        • API String ID: 2764975409-3930272192
                                                                                                                                                                                                                        • Opcode ID: 79c64c009af6a48365fe71c4024355bf7de87f9ee93ebd1caee51fb3ec388da9
                                                                                                                                                                                                                        • Instruction ID: bf66af2731d5d20edad243a39a6c33fc7d46c1709f1e4239311970086677da09
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 79c64c009af6a48365fe71c4024355bf7de87f9ee93ebd1caee51fb3ec388da9
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4D0126301183019FD700EF68DD06D6E7BF4FF84301F844868F84882210EB7499999B12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05006580 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?minimumSize@QWindow@@QBE?AVQSize@@XZ.QT5GUI(?), ref: 050065C5
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(?), ref: 050065CE
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?minimumFromLongLong_Size@Size@@Window@@
                                                                                                                                                                                                                        • String ID: QWindow$minimumHeight$minimumHeight(self) -> int
                                                                                                                                                                                                                        • API String ID: 430898146-3833431472
                                                                                                                                                                                                                        • Opcode ID: 3af91c6e2bc9fb87ce6a620f1ccbf5f43d39a3141aa9589f0902ddefe3046eb0
                                                                                                                                                                                                                        • Instruction ID: 26e0f7173dfe66b41854b1c1561944e79e4ee95e97a81b1d76bd0ef55daf0cb4
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3af91c6e2bc9fb87ce6a620f1ccbf5f43d39a3141aa9589f0902ddefe3046eb0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9D012870114202AFEB00EFA4DD46D6E7BE8FF84301F844864F94CC7221E775E9599B12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050105B0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?boolProperty@QTextFormat@@QBE_NH@Z.QT5GUI(00004105), ref: 050105F5
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 050105FF
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?boolBool_Format@@FromLongProperty@Text
                                                                                                                                                                                                                        • String ID: QTextTableFormat$borderCollapse$borderCollapse(self) -> bool
                                                                                                                                                                                                                        • API String ID: 3344510876-2026970299
                                                                                                                                                                                                                        • Opcode ID: 1ecc766eda38afc4e49839bbb6c82a2c63abbc9b3939c07b45d2b1a5be77c747
                                                                                                                                                                                                                        • Instruction ID: 6a660d6644567b3bdea64b9047822c716d261e40141ffcab137ef72155c5fa7c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1ecc766eda38afc4e49839bbb6c82a2c63abbc9b3939c07b45d2b1a5be77c747
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2EF0A470254201AFDB01EFA4ED46E6A77E4FB84701F440474F948C7240D6B9E9599B62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0502E6C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?boolProperty@QTextFormat@@QBE_NH@Z.QT5GUI(00002030), ref: 0502E705
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 0502E70F
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?boolBool_Format@@FromLongProperty@Text
                                                                                                                                                                                                                        • String ID: QTextCharFormat$isAnchor$isAnchor(self) -> bool
                                                                                                                                                                                                                        • API String ID: 3344510876-2218162327
                                                                                                                                                                                                                        • Opcode ID: ca939763bf83ee5a671acca9fb30d12fd471cd2cc6561d1c6dadb8199569b967
                                                                                                                                                                                                                        • Instruction ID: 2c94ab7f03e5516c65d86cb7f0448f82dfcab1284c75708efdcd343478cd0a12
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ca939763bf83ee5a671acca9fb30d12fd471cd2cc6561d1c6dadb8199569b967
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5DF02830154301AFDB00EFA0ED46E6E3BE8FB84701F440464F948C7241D6B8EA19DB63
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05006500 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?allowsInteraction@QSessionManager@@QAE_NXZ.QT5GUI ref: 05006540
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 0500654A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?allowsBool_FromInteraction@LongManager@@Session
                                                                                                                                                                                                                        • String ID: QSessionManager$allowsInteraction$allowsInteraction(self) -> bool
                                                                                                                                                                                                                        • API String ID: 2652149013-2202868040
                                                                                                                                                                                                                        • Opcode ID: 32c56ad25847f48091584903444b704733f46edfc354fed4a5004be0028d0321
                                                                                                                                                                                                                        • Instruction ID: 1b45859b7dfcc4715fe598dd29aae4ff2b9c9c477b2dc0630ce8f7c62b82d6ad
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 32c56ad25847f48091584903444b704733f46edfc354fed4a5004be0028d0321
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C8F0A470144201AFDA00EBA4ED46D6E7BE8FB84701F444864F948C7251D7B9EE59DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050285C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?isValid@QRawFont@@QBE_NXZ.QT5GUI ref: 05028600
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 0502860A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Bool_Font@@FromLongValid@
                                                                                                                                                                                                                        • String ID: QRawFont$isValid$isValid(self) -> bool
                                                                                                                                                                                                                        • API String ID: 1506279342-2331607452
                                                                                                                                                                                                                        • Opcode ID: 048c66852017f80b67c21717771755ee1d44d268ae80a593ab3dc3f664c88531
                                                                                                                                                                                                                        • Instruction ID: d5f08a83300a8848e5d810d909e50fcb5f6603cafc1811a589ed2722479e7b78
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 048c66852017f80b67c21717771755ee1d44d268ae80a593ab3dc3f664c88531
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 20F0F470148201AFCB00EFA0ED06D6A3BE8FB84701F440824F948C3211E678ED58DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050844F0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36clipboardCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?ownsFindBuffer@QClipboard@@QBE_NXZ.QT5GUI ref: 05084530
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 0508453A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?ownsBool_Buffer@Clipboard@@FindFromLong
                                                                                                                                                                                                                        • String ID: QClipboard$ownsFindBuffer$ownsFindBuffer(self) -> bool
                                                                                                                                                                                                                        • API String ID: 2876875301-822326524
                                                                                                                                                                                                                        • Opcode ID: 2fdbd813575908424a1c5cd860f54b39c66142bca31e6a1d67b67c6a299970b9
                                                                                                                                                                                                                        • Instruction ID: 659692a4391701252ae4ace4bc6a6eb502703ab0a86391997ab2f245f4b54faf
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2fdbd813575908424a1c5cd860f54b39c66142bca31e6a1d67b67c6a299970b9
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5EF0AF70544201AFDB00EFA4ED46E6E7BE8FB84A01F840864F948D7250D7B9EE99DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0509A4F0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?create@QOpenGLBuffer@@QAE_NXZ.QT5GUI ref: 0509A530
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 0509A53A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?create@Bool_Buffer@@FromLongOpen
                                                                                                                                                                                                                        • String ID: QOpenGLBuffer$create$create(self) -> bool
                                                                                                                                                                                                                        • API String ID: 1433463350-2236000085
                                                                                                                                                                                                                        • Opcode ID: d137ed5463a61343b0eadf14b4cf3de3662ed71b33c7107798e95303d8f1c5df
                                                                                                                                                                                                                        • Instruction ID: 45e41e3d9cd28be07d8538075222fdc36e3663c0cf312b3cb2d05b5ece52e5e3
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d137ed5463a61343b0eadf14b4cf3de3662ed71b33c7107798e95303d8f1c5df
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9AF08C70654201AFDA00EBA4ED06E6A7BE4BB84701F444874F948C6610E7B9EA59EB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0500C700 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?isNull@QPicture@@QBE_NXZ.QT5GUI ref: 0500C740
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 0500C74A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Bool_FromLongNull@Picture@@
                                                                                                                                                                                                                        • String ID: QPicture$isNull$isNull(self) -> bool
                                                                                                                                                                                                                        • API String ID: 2563993319-1802485065
                                                                                                                                                                                                                        • Opcode ID: 8ff7318ed51126059ece2d0ea679e3129c421e773706251e5b33d0daf3149b68
                                                                                                                                                                                                                        • Instruction ID: fe4790a360363d447f4b07eaa61de8b394cd496093bbde74f5a292289d125f99
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8ff7318ed51126059ece2d0ea679e3129c421e773706251e5b33d0daf3149b68
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 64F0FF30154201AFEA00EBA0EE06D6E7BE8FB84701F440864F848C7250D7B8EE59EB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05054710 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?isUserTristate@QStandardItem@@QBE_NXZ.QT5GUI ref: 05054750
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 0505475A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Bool_FromItem@@LongStandardTristate@User
                                                                                                                                                                                                                        • String ID: QStandardItem$isUserTristate$isUserTristate(self) -> bool
                                                                                                                                                                                                                        • API String ID: 345474580-11136386
                                                                                                                                                                                                                        • Opcode ID: 88148927d58de91f6985cb0e16177b7b88f5e64922fb8159465a972bb5466e26
                                                                                                                                                                                                                        • Instruction ID: 867ed41ef01eb43dc306712266367b623e1d16e0c1703682c48d0e23058cc980
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 88148927d58de91f6985cb0e16177b7b88f5e64922fb8159465a972bb5466e26
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 47F0A470544205AFDA00EFA4ED46E6E7BE8FB84701F440864F948C7250E778EE59DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0501A730 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?startSystemMove@QWindow@@QAE_NXZ.QT5GUI ref: 0501A770
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 0501A77A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?startBool_FromLongMove@SystemWindow@@
                                                                                                                                                                                                                        • String ID: QWindow$startSystemMove$startSystemMove(self) -> bool
                                                                                                                                                                                                                        • API String ID: 4180735198-3765074379
                                                                                                                                                                                                                        • Opcode ID: 4ea981b6492db0cda24843af121dcdd4cd27e373c88963ae649afce3c5fb9cd3
                                                                                                                                                                                                                        • Instruction ID: 260f04efbc5a877d1c8af3224740cc8c047ad00cd0323ca521dddf7531a74c44
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4ea981b6492db0cda24843af121dcdd4cd27e373c88963ae649afce3c5fb9cd3
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A3F0AF70554201AFDB00EBA4ED06E6E7BE8BB84601F440864FD48C7250D679EE69DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0502E750 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?end@QPainter@@QAE_NXZ.QT5GUI ref: 0502E790
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 0502E79A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?end@Bool_FromLongPainter@@
                                                                                                                                                                                                                        • String ID: QPainter$end$end(self) -> bool
                                                                                                                                                                                                                        • API String ID: 3078279030-2907001754
                                                                                                                                                                                                                        • Opcode ID: cf340c8675f84467f8fe1380c710a418583947d850db06cd571f98018272b5dd
                                                                                                                                                                                                                        • Instruction ID: bc9cc7d9c35f468df73fc8d439485ddc7ef4288da2b45955f25b57688c7e1228
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: cf340c8675f84467f8fe1380c710a418583947d850db06cd571f98018272b5dd
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F0F0D130144201ABDA00EBA0FD06D6A7BE8BB84701F840874F948C2210D679A959DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0508A750 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?isOpenGLES@QOpenGLContext@@QBE_NXZ.QT5GUI ref: 0508A790
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 0508A79A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Open$Bool_Context@@FromLong
                                                                                                                                                                                                                        • String ID: QOpenGLContext$isOpenGLES$isOpenGLES(self) -> bool
                                                                                                                                                                                                                        • API String ID: 3114037576-477472611
                                                                                                                                                                                                                        • Opcode ID: eccdeb04c884b04f3af328bf62586237a04aebaf88979eaaa04ef04a03511fab
                                                                                                                                                                                                                        • Instruction ID: 679d3686bc58ce2ef1385ab83d0c97a6f395fab95976dba8edea187279f33aef
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: eccdeb04c884b04f3af328bf62586237a04aebaf88979eaaa04ef04a03511fab
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B7F0F474144201AFCA00EF90ED02E6D37E4FB84701F400864F988C7610D778EE18DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FEC620 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?isUndoRedoEnabled@QTextDocument@@QBE_NXZ.QT5GUI ref: 04FEC660
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 04FEC66A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Bool_Document@@Enabled@FromLongRedoTextUndo
                                                                                                                                                                                                                        • String ID: QTextDocument$isUndoRedoEnabled$isUndoRedoEnabled(self) -> bool
                                                                                                                                                                                                                        • API String ID: 2790603972-3862089265
                                                                                                                                                                                                                        • Opcode ID: 5d161c11e82a3217ecff4d7b175786acfcba990a84d259bc5bf5b21085e60bc0
                                                                                                                                                                                                                        • Instruction ID: ac560e4267d5fa114c882651a10eb5831562016c91a8f091b87c31431934b236
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5d161c11e82a3217ecff4d7b175786acfcba990a84d259bc5bf5b21085e60bc0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A1F0FF70544201AFCB01EFA4ED06E6A3BE8FB84702F400824F848C7210DBB8EA59DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05080610 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?isValid@QColorSpace@@QBE_NXZ.QT5GUI ref: 05080650
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 0508065A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Bool_ColorFromLongSpace@@Valid@
                                                                                                                                                                                                                        • String ID: QColorSpace$isValid$isValid(self) -> bool
                                                                                                                                                                                                                        • API String ID: 974838815-1024435711
                                                                                                                                                                                                                        • Opcode ID: 25af1c640b96c3939b10160f09b2a36b98e8587d2d317157f912aa634fd6edfa
                                                                                                                                                                                                                        • Instruction ID: 41f43207b1ea1affa954ceb1daef581716716294f10fe945574bd634ed57c117
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 25af1c640b96c3939b10160f09b2a36b98e8587d2d317157f912aa634fd6edfa
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B2F0A470544205AFDA00EFA4ED46D6A77E8BB84701F480864F948C7250D7B9ED6AEB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05084640 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36clipboardCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?ownsSelection@QClipboard@@QBE_NXZ.QT5GUI ref: 05084680
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 0508468A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?ownsBool_Clipboard@@FromLongSelection@
                                                                                                                                                                                                                        • String ID: QClipboard$ownsSelection$ownsSelection(self) -> bool
                                                                                                                                                                                                                        • API String ID: 1085878218-1922042281
                                                                                                                                                                                                                        • Opcode ID: 93b3ea6d8794893019c626dad66cc74520ad5b528b6aba4709113077e2bf4cd3
                                                                                                                                                                                                                        • Instruction ID: afb8eee5e89996da042e4ee639914768d36c140ac1fec8ba8fd6bd19f7b19799
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 93b3ea6d8794893019c626dad66cc74520ad5b528b6aba4709113077e2bf4cd3
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BAF0F470604201AFCA00EF90ED06E697BE4FB84701F440864F848C3200D7B8EE69DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05048680 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?isDragEnabled@QStandardItem@@QBE_NXZ.QT5GUI ref: 050486C0
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 050486CA
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Bool_DragEnabled@FromItem@@LongStandard
                                                                                                                                                                                                                        • String ID: QStandardItem$isDragEnabled$isDragEnabled(self) -> bool
                                                                                                                                                                                                                        • API String ID: 899098581-2214694240
                                                                                                                                                                                                                        • Opcode ID: 3b7359dbefc2b5c982dc5e22b1c75184a7004573a954d677e34ddf6c3acef15d
                                                                                                                                                                                                                        • Instruction ID: b4a27e41571b750b4ac219c56eeb2ad701b7af3f8278163387cfcb52318e0089
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3b7359dbefc2b5c982dc5e22b1c75184a7004573a954d677e34ddf6c3acef15d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A2F0FF70244201AFDB00EFA0ED06E6E3BE8FB84701F400875F948C7201E7B9EA59DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0503E570 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?firstLineNumber@QTextBlock@@QBEHXZ.QT5GUI ref: 0503E5B0
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(00000000), ref: 0503E5B7
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?firstBlock@@FromLineLongLong_Number@Text
                                                                                                                                                                                                                        • String ID: QTextBlock$firstLineNumber$firstLineNumber(self) -> int
                                                                                                                                                                                                                        • API String ID: 980265188-4235043368
                                                                                                                                                                                                                        • Opcode ID: 24fa719d80f2b8ec08bd8b17c01caa4a142b420e6bc9bc9ede74c3ed21a697c1
                                                                                                                                                                                                                        • Instruction ID: 6489b71c8a688c63eedc957aff69e2d8ecc51f4e6da0fb38ea18ae438e9c17be
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 24fa719d80f2b8ec08bd8b17c01caa4a142b420e6bc9bc9ede74c3ed21a697c1
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 25F0FF30504201AFDB01EFA0ED06EAA37E8FB88701F400424F948C7200E778E959DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FE6400 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?senderSignalIndex@QObject@@IBEHXZ.QT5CORE ref: 04FE6440
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(00000000), ref: 04FE6447
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?senderFromIndex@LongLong_Object@@Signal
                                                                                                                                                                                                                        • String ID: QTextBlockGroup$senderSignalIndex$senderSignalIndex(self) -> int
                                                                                                                                                                                                                        • API String ID: 2462028585-2797169557
                                                                                                                                                                                                                        • Opcode ID: 6eb90bfed530c7f24e71051708e771bd749ddaf79402073f972de2493bd88320
                                                                                                                                                                                                                        • Instruction ID: bb4e0a6719b6b200288955358f03ae312c0f5db20a46f737a5b98c2005cc5bfd
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6eb90bfed530c7f24e71051708e771bd749ddaf79402073f972de2493bd88320
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0EF0C270544201AFDB00EFA4ED46E6A7BE8FB84701F440474F948D7210EB79ED59DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0500C400 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?positionInBlock@QTextCursor@@QBEHXZ.QT5GUI ref: 0500C440
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(00000000), ref: 0500C447
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?positionBlock@Cursor@@FromLongLong_Text
                                                                                                                                                                                                                        • String ID: QTextCursor$positionInBlock$positionInBlock(self) -> int
                                                                                                                                                                                                                        • API String ID: 3223810010-281852591
                                                                                                                                                                                                                        • Opcode ID: 7c12be0035abb45df115bfacdf5d62580fca5dae33ac5c7b333076465ba387fd
                                                                                                                                                                                                                        • Instruction ID: 601841903aedaae4e8a07453c97f1df70ce28fd50fbd91af8bbc5ebdc9c699e9
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7c12be0035abb45df115bfacdf5d62580fca5dae33ac5c7b333076465ba387fd
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1CF0FF30104201AFDB00EBA4EC07E6E7BE8FB84701F440428F948D7241EA78AE58DB92
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0506E430 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?depth@QImage@@QBEHXZ.QT5GUI ref: 0506E470
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(00000000), ref: 0506E477
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?depth@FromImage@@LongLong_
                                                                                                                                                                                                                        • String ID: QPixmap$depth$depth(self) -> int
                                                                                                                                                                                                                        • API String ID: 4199929637-554661616
                                                                                                                                                                                                                        • Opcode ID: dc2a9df6c463400ab01f227bac4c381e53bcb065e563344301f985db3c94f86e
                                                                                                                                                                                                                        • Instruction ID: 854a03be6f483eaed6ca6d073a2167321174e0cffe5f903eb6f540d127ad9531
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: dc2a9df6c463400ab01f227bac4c381e53bcb065e563344301f985db3c94f86e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BEF0C274154202AFDB00EFA4ED46D6A7BE8FB84701F440824F948D3251E7B8ED59DBA2
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05026440 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?style@QPen@@QBE?AW4PenStyle@Qt@@XZ.QT5GUI ref: 05026480
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(00000000), ref: 05026487
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?style@FromLongLong_Pen@@Qt@@Style@
                                                                                                                                                                                                                        • String ID: QSurfaceFormat$alphaBufferSize$alphaBufferSize(self) -> int
                                                                                                                                                                                                                        • API String ID: 3318696005-3301355687
                                                                                                                                                                                                                        • Opcode ID: 525bd74ce27c0101f8beee6f337b72985c8a64042d0c88ddd17554e244432b0b
                                                                                                                                                                                                                        • Instruction ID: a65873eb2bd51616b776a9f11835faef3f81d078c74318d54028d859c7759e68
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 525bd74ce27c0101f8beee6f337b72985c8a64042d0c88ddd17554e244432b0b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 96F0C270154201AFEB01EFA4ED46E6E77E8FB84701F840824F948D7210EB79ED59DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05000470 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?senderSignalIndex@QObject@@IBEHXZ.QT5CORE ref: 050004B0
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(00000000), ref: 050004B7
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?senderFromIndex@LongLong_Object@@Signal
                                                                                                                                                                                                                        • String ID: QWindow$senderSignalIndex$senderSignalIndex(self) -> int
                                                                                                                                                                                                                        • API String ID: 2462028585-3750479878
                                                                                                                                                                                                                        • Opcode ID: 7f99f6ab14575ee35dc59dfe5580ea059f3959a518987b596e1a6236513a2902
                                                                                                                                                                                                                        • Instruction ID: ab5905a4176dd511243098dd01daf8c783389aee2b71b74ece329d35f3e328dc
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7f99f6ab14575ee35dc59dfe5580ea059f3959a518987b596e1a6236513a2902
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 22F0AF70154201AFDB00EBA4ED46E5A7BE8FB84701F440464F988D7250D679E959DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0504A470 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?senderSignalIndex@QObject@@IBEHXZ.QT5CORE ref: 0504A4B0
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(00000000), ref: 0504A4B7
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • senderSignalIndex, xrefs: 0504A4CE
                                                                                                                                                                                                                        • senderSignalIndex(self) -> int, xrefs: 0504A4C9
                                                                                                                                                                                                                        • QRegularExpressionValidator, xrefs: 0504A4D3
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?senderFromIndex@LongLong_Object@@Signal
                                                                                                                                                                                                                        • String ID: QRegularExpressionValidator$senderSignalIndex$senderSignalIndex(self) -> int
                                                                                                                                                                                                                        • API String ID: 2462028585-3156835661
                                                                                                                                                                                                                        • Opcode ID: a7db616f69b80f3a5a29080b33879b72a90daf6a18c6f43df6e096beef2a5a8c
                                                                                                                                                                                                                        • Instruction ID: 10523cbe8f3bf818de2b9b1fadaa1b4900d0ab9d71e136c93a78f3f5cdf01e6d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a7db616f69b80f3a5a29080b33879b72a90daf6a18c6f43df6e096beef2a5a8c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 17F0AF70244201AFDB00EBA4FD46E5E7BE9FB84711F840834F948D3251DBB9E959DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FFC580 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?lineCount@QTextDocument@@QBEHXZ.QT5GUI ref: 04FFC5C0
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(00000000), ref: 04FFC5C7
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?lineCount@Document@@FromLongLong_Text
                                                                                                                                                                                                                        • String ID: QTextDocument$lineCount$lineCount(self) -> int
                                                                                                                                                                                                                        • API String ID: 3258379902-1896213649
                                                                                                                                                                                                                        • Opcode ID: ebea5a12d98ef4b1d240ab92c9a7da2b728419380227143020ff6f4533205c78
                                                                                                                                                                                                                        • Instruction ID: 90975f54249140190b7562e91a0f799ea163db422325a561bcedfd3db3238b2e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ebea5a12d98ef4b1d240ab92c9a7da2b728419380227143020ff6f4533205c78
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 08F0AF70644201AFDB01EBA4ED06E6A7BE8FB84701F440424F948D7210EB79E959DB92
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05076480 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?dotsPerMeterY@QImage@@QBEHXZ.QT5GUI ref: 050764C0
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(00000000), ref: 050764C7
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?dotsFromImage@@LongLong_Meter
                                                                                                                                                                                                                        • String ID: QImage$dotsPerMeterY$dotsPerMeterY(self) -> int
                                                                                                                                                                                                                        • API String ID: 945573293-4076906065
                                                                                                                                                                                                                        • Opcode ID: a9ccbd6ec470b91e032c0bef4ee14ef0d48f31e5a9829c2e39326d2b04c2c764
                                                                                                                                                                                                                        • Instruction ID: 5a1b68f54c74362f040db3713b1ca7ce57c190834a9ae6ac27708508e4975ea8
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a9ccbd6ec470b91e032c0bef4ee14ef0d48f31e5a9829c2e39326d2b04c2c764
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 12F02270604202AFCB00EFA0ED02D5A3BE8FB84701F440864F948D3250DB78EE59EB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050824E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?physicalDpiY@QPaintDevice@@QBEHXZ.QT5GUI ref: 05082520
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(00000000), ref: 05082527
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?physicalDevice@@FromLongLong_Paint
                                                                                                                                                                                                                        • String ID: QPaintDevice$physicalDpiY$physicalDpiY(self) -> int
                                                                                                                                                                                                                        • API String ID: 2621510204-2459562932
                                                                                                                                                                                                                        • Opcode ID: f4f986ce0f7e6d2a39e84ec2efaf0a908b0f477c7ca85c2f9800763e674b49ae
                                                                                                                                                                                                                        • Instruction ID: edf96e2160213e3bd91e0dd86a75634c7025c7ce02e7e893c510a85a6902322a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f4f986ce0f7e6d2a39e84ec2efaf0a908b0f477c7ca85c2f9800763e674b49ae
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: DFF0C270554201AFDB00EFA4ED06E6A7BE8FB84701F440474F948D7210EBB8ED59DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0503E710 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?type@QTextFormat@@QBEHXZ.QT5GUI ref: 0503E750
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(00000000), ref: 0503E757
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?type@Format@@FromLongLong_Text
                                                                                                                                                                                                                        • String ID: QTextFormat$type$type(self) -> int
                                                                                                                                                                                                                        • API String ID: 3741527453-4040809220
                                                                                                                                                                                                                        • Opcode ID: 9ba0f96527960261b43947d42a69ebba3266ca38d32aff3e53f0b3b7c4d63fdf
                                                                                                                                                                                                                        • Instruction ID: 481ac773de1856ed63e14cf3219a9ed634e3f2f163251ec3608003365f54fb79
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9ba0f96527960261b43947d42a69ebba3266ca38d32aff3e53f0b3b7c4d63fdf
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 50F0AF70544201AFDB00EFA4EE06E9A7BE8BB84701F440424F948D7210EBB8ED59DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05090710 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?patchVertexCount@QOpenGLShaderProgram@@QBEHXZ.QT5GUI ref: 05090750
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(00000000), ref: 05090757
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?patchCount@FromLongLong_OpenProgram@@ShaderVertex
                                                                                                                                                                                                                        • String ID: QOpenGLShaderProgram$patchVertexCount$patchVertexCount(self) -> int
                                                                                                                                                                                                                        • API String ID: 2875401739-3738994743
                                                                                                                                                                                                                        • Opcode ID: ddc3b3fd6d0db34f5ba5c21289678c2247e78edc4c6725433b8fad1d30273de0
                                                                                                                                                                                                                        • Instruction ID: bf97a6e42c9070e9f90041d8fb9457a47a40eba8720743b54733c26fde461c41
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ddc3b3fd6d0db34f5ba5c21289678c2247e78edc4c6725433b8fad1d30273de0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B5F0F434144201AFCA00EFA0ED06D5E77E4BF84701F440824F948C7200E778AE58DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0500C780 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?verticalMovementX@QTextCursor@@QBEHXZ.QT5GUI ref: 0500C7C0
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(00000000), ref: 0500C7C7
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?verticalCursor@@FromLongLong_MovementText
                                                                                                                                                                                                                        • String ID: QTextCursor$verticalMovementX$verticalMovementX(self) -> int
                                                                                                                                                                                                                        • API String ID: 809924778-2152589566
                                                                                                                                                                                                                        • Opcode ID: c2107e70b7d6b0f93e182c0ff2a2bfae13ffe0006948aa993588c4aefdb43b49
                                                                                                                                                                                                                        • Instruction ID: 54812e5b629a2e0b128517ad3ef24a544e8b74eac373369269129bdeaa5cf852
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c2107e70b7d6b0f93e182c0ff2a2bfae13ffe0006948aa993588c4aefdb43b49
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 24F0AF70154201AFDB00EFA4ED46E6E77E8FB88701F840428F948D7210EB78AD59DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0503C780 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?userState@QTextBlock@@QBEHXZ.QT5GUI ref: 0503C7C0
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(00000000), ref: 0503C7C7
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?userBlock@@FromLongLong_State@Text
                                                                                                                                                                                                                        • String ID: QTextBlock$userState$userState(self) -> int
                                                                                                                                                                                                                        • API String ID: 1611606485-3269253637
                                                                                                                                                                                                                        • Opcode ID: 509ec90ab50b4c3a57485cc089ead02d6c9aef35cee2c0dc2d4c5a6fca84f32e
                                                                                                                                                                                                                        • Instruction ID: 0c1cf522f3741dcf6ea669b896c4225aa6635b705dfc1b81d2d30d1765c8c58d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 509ec90ab50b4c3a57485cc089ead02d6c9aef35cee2c0dc2d4c5a6fca84f32e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 51F02230144201AFDB01EFA0EE06E6E7BE8FB88701F440464F948D7210EBB8ED59DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050267D0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?resolution@QPdfWriter@@QBEHXZ.QT5GUI ref: 05026810
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(00000000), ref: 05026817
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?resolution@FromLongLong_Writer@@
                                                                                                                                                                                                                        • String ID: QPdfWriter$resolution$resolution(self) -> int
                                                                                                                                                                                                                        • API String ID: 895603379-2738754282
                                                                                                                                                                                                                        • Opcode ID: aedb17d1ca7904f0a4908d9449f4613e3891b077de681f86062c5b06eeb20c75
                                                                                                                                                                                                                        • Instruction ID: aac2cd3a9c5e4ba09a227ae29e3bd193ae00e0716473b7b35bee44a0274cbe64
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: aedb17d1ca7904f0a4908d9449f4613e3891b077de681f86062c5b06eeb20c75
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 39F0AF70554201AFDB01EFA4FD46E5A7BE8BB84701F840424F948D7210DB79ED59DBA2
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050387D0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?mouseDoubleClickDistance@QStyleHints@@QBEHXZ.QT5GUI ref: 05038810
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(00000000), ref: 05038817
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • mouseDoubleClickDistance(self) -> int, xrefs: 05038829
                                                                                                                                                                                                                        • QStyleHints, xrefs: 05038833
                                                                                                                                                                                                                        • mouseDoubleClickDistance, xrefs: 0503882E
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?mouseClickDistance@DoubleFromHints@@LongLong_Style
                                                                                                                                                                                                                        • String ID: QStyleHints$mouseDoubleClickDistance$mouseDoubleClickDistance(self) -> int
                                                                                                                                                                                                                        • API String ID: 433758185-3706968992
                                                                                                                                                                                                                        • Opcode ID: 2a7a107a94a4f1652a696b3c6f9e33d4ce90b1e001f7aed5d311952d54f740da
                                                                                                                                                                                                                        • Instruction ID: 368f231b4c6c090174b48209a335143b3244b23c30891589d28ef7cbe13e69c5
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2a7a107a94a4f1652a696b3c6f9e33d4ce90b1e001f7aed5d311952d54f740da
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7CF0FF30508201AFDB00EFA0ED02D5A3BE8FB84701F840824F948C7250EB78AE59DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05034630 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?startDragDistance@QStyleHints@@QBEHXZ.QT5GUI ref: 05034670
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(00000000), ref: 05034677
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?startDistance@DragFromHints@@LongLong_Style
                                                                                                                                                                                                                        • String ID: QStyleHints$startDragDistance$startDragDistance(self) -> int
                                                                                                                                                                                                                        • API String ID: 3834017869-894407624
                                                                                                                                                                                                                        • Opcode ID: aa02ea14396c8aedcd251a8fd17db6e9279db5ef444daaf9509e039e0b6ad5bc
                                                                                                                                                                                                                        • Instruction ID: 0fd18a2dc97659972509b3d538cfabf89b714354f75f6f3f6575d92e66eadb75
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: aa02ea14396c8aedcd251a8fd17db6e9279db5ef444daaf9509e039e0b6ad5bc
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 13F0FF70104205AFDB00EFA4ED06E5E3BE8FB84701F840824F948C7211EA78EE59DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0501A670 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?senderSignalIndex@QObject@@IBEHXZ.QT5CORE ref: 0501A6B0
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(00000000), ref: 0501A6B7
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?senderFromIndex@LongLong_Object@@Signal
                                                                                                                                                                                                                        • String ID: QSyntaxHighlighter$senderSignalIndex$senderSignalIndex(self) -> int
                                                                                                                                                                                                                        • API String ID: 2462028585-1401132467
                                                                                                                                                                                                                        • Opcode ID: 20a7312c999761dd49fec8bbb921885910fec3c7baf48489ebd6e5dd84b06274
                                                                                                                                                                                                                        • Instruction ID: cd0b32340373bece3d58722eaeb0c3afffa47329637f4ff35cefd3902decca79
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 20a7312c999761dd49fec8bbb921885910fec3c7baf48489ebd6e5dd84b06274
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4CF0AF70644201AFDB00EBA4ED06E5A7BE8FB84701F440434F948D7250E679ED59DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0504A6A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?rowCount@QStandardItem@@QBEHXZ.QT5GUI ref: 0504A6E0
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(00000000), ref: 0504A6E7
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?rowCount@FromItem@@LongLong_Standard
                                                                                                                                                                                                                        • String ID: QStandardItem$rowCount$rowCount(self) -> int
                                                                                                                                                                                                                        • API String ID: 3772066395-2180684922
                                                                                                                                                                                                                        • Opcode ID: a207c699599c527cdd8369650572c7a80b7c48504eb1aaf23ea2087809c916cd
                                                                                                                                                                                                                        • Instruction ID: 2e8bd5bd5031a7e96d89c8274b73c0dfc134f08c3217d048a498465883393f84
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a207c699599c527cdd8369650572c7a80b7c48504eb1aaf23ea2087809c916cd
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3EF0AF70244201AFDB00EFA4ED46E5E7BE8FB88701F444424F948D7650E7B8AD59DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00403030 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 30stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • _errno.MSVCRT ref: 00403064
                                                                                                                                                                                                                        • strerror.MSVCRT ref: 0040306F
                                                                                                                                                                                                                          • Part of subcall function 00402DF0: MessageBoxW.USER32 ref: 00402E78
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Message_errnostrerror
                                                                                                                                                                                                                        • String ID: %s%s: %s$0$Fatal error detected
                                                                                                                                                                                                                        • API String ID: 132859757-319980707
                                                                                                                                                                                                                        • Opcode ID: 75b9b436fd89f2a30938fcb7b058be5ee0d31631848f3b8384897b5255f1b178
                                                                                                                                                                                                                        • Instruction ID: e4a221d579113a631f8ff3878a8ccab0824710bde975c9094fb448246fb893e6
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 75b9b436fd89f2a30938fcb7b058be5ee0d31631848f3b8384897b5255f1b178
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 540180B4409345DFC750EF65D18464ABBE0FF88749F408C2EE4C897251EB789948DF96
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FFA6F0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 29COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?cacheLimit@QPixmapCache@@SAHXZ.QT5GUI ref: 04FFA71B
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(00000000), ref: 04FFA722
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?cacheCache@@FromLimit@LongLong_Pixmap
                                                                                                                                                                                                                        • String ID: QPixmapCache$cacheLimit$cacheLimit() -> int
                                                                                                                                                                                                                        • API String ID: 983417776-2926451805
                                                                                                                                                                                                                        • Opcode ID: 529e380a644cfc205b2ab04aa1d30666065e230657dafdebbc937bde36b1b950
                                                                                                                                                                                                                        • Instruction ID: 5392e9c2ac7253fcc79fe69e94612e1a2c76aa8abcadd9cfabaa7070a6aece05
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 529e380a644cfc205b2ab04aa1d30666065e230657dafdebbc937bde36b1b950
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 40F02071654201AFDB00CBA0EC0AE0A3BE4EB84311F184464F909C7662DBB4E855AB01
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00401DBB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 00403030: _errno.MSVCRT ref: 00403064
                                                                                                                                                                                                                          • Part of subcall function 00403030: strerror.MSVCRT ref: 0040306F
                                                                                                                                                                                                                        • free.MSVCRT ref: 00401D25
                                                                                                                                                                                                                        • fclose.MSVCRT ref: 00401D50
                                                                                                                                                                                                                        • fclose.MSVCRT ref: 00401D63
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to extract %s: failed to write data chunk!, xrefs: 00401DC4
                                                                                                                                                                                                                        • fwrite, xrefs: 00401DD1
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: fclose$_errnofreestrerror
                                                                                                                                                                                                                        • String ID: Failed to extract %s: failed to write data chunk!$fwrite
                                                                                                                                                                                                                        • API String ID: 3523629215-1560601992
                                                                                                                                                                                                                        • Opcode ID: 9353a7da99b3be11b46e5f84fdf26ac4210b160aba239bd7510e2b4b1990afc0
                                                                                                                                                                                                                        • Instruction ID: aff44569ab8606813c7f29ae03d31c1d370def72fb3cd313521a05d94b0daf67
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9353a7da99b3be11b46e5f84fdf26ac4210b160aba239bd7510e2b4b1990afc0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 43F012B56093408BC700AF75E48519DB7E0BF80314F12892FF4999B291D338D485CB4A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05014560 Relevance: 7.6, APIs: 5, Instructions: 81COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyList_New.PYTHON3(?), ref: 05014571
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ??0QGlyphRun@@QAE@ABV0@@Z.QT5GUI(?), ref: 050145AC
                                                                                                                                                                                                                        • PyList_SetItem.PYTHON3(00000000,00000000,00000000), ref: 050145D4
                                                                                                                                                                                                                        • ??1QGlyphRun@@QAE@XZ.QT5GUI ref: 050145F7
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(00000000), ref: 05014619
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: GlyphList_Run@@$DeallocItemV0@@malloc
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 650968534-0
                                                                                                                                                                                                                        • Opcode ID: b3d619428373d9c054ccf8eeb8272b6b7e8275275a71e43af0c36c58a7562d04
                                                                                                                                                                                                                        • Instruction ID: e8ef6dc13984b5630a174ab7c39a51e5110b7fc130c76937558e30113987ea5a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b3d619428373d9c054ccf8eeb8272b6b7e8275275a71e43af0c36c58a7562d04
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 122107763001019FC714DF68EC99E6EBBA6FF84325B184128FD0A8B255EF71E806CB56
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00402A70 Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: DialogLongWindow$InvalidateRect
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1200242243-0
                                                                                                                                                                                                                        • Opcode ID: 3787fa5d93e67dc4f7c943341e9a8d3195f1a3fb92f8390d8411d98647bb4722
                                                                                                                                                                                                                        • Instruction ID: 27a3fa5a97dc3583b937ce51c481d096ba8d8761c7d493d8dec02a740509071e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3787fa5d93e67dc4f7c943341e9a8d3195f1a3fb92f8390d8411d98647bb4722
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1A2160715082108FD310AF2CDA8925EBBE0FB84704F01893EF88A973D5D7B98949CB97
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050D85D0 Relevance: 7.6, APIs: 5, Instructions: 63COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 050D85E2
                                                                                                                                                                                                                        • PyTuple_New.PYTHON3(?), ref: 050D85F1
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 050D8619
                                                                                                                                                                                                                        • PyTuple_SetItem.PYTHON3(00000000,00000000,00000000), ref: 050D8629
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Bool_FromLongTuple_$Item
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 197598993-0
                                                                                                                                                                                                                        • Opcode ID: 6054afd29856ab4b001ccbe3f061c1450df7bc843dd3eb9d374afe1d1d3c6a8b
                                                                                                                                                                                                                        • Instruction ID: 8a8ededa82eff032184653ef19f5a63043047b08a5da78674007c0e58be34b3c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6054afd29856ab4b001ccbe3f061c1450df7bc843dd3eb9d374afe1d1d3c6a8b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1A1108B16043004BC6509B69BC8896FBFE8FF82672B284971F856C7241DB76E41AC772
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050D8710 Relevance: 7.6, APIs: 5, Instructions: 62COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyFloat_FromDouble.PYTHON3 ref: 050D872D
                                                                                                                                                                                                                        • PyTuple_New.PYTHON3(?), ref: 050D873B
                                                                                                                                                                                                                        • PyFloat_FromDouble.PYTHON3 ref: 050D8764
                                                                                                                                                                                                                        • PyTuple_SetItem.PYTHON3(00000000,00000000,00000000), ref: 050D8774
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: DoubleFloat_FromTuple_$Item
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3480476165-0
                                                                                                                                                                                                                        • Opcode ID: a50e7de15d9bfd33af7a0b51b9fe2ad041017bc3f3f5b7043728a55a260fc488
                                                                                                                                                                                                                        • Instruction ID: e05b593c81c21993bd38f948530b3ac46b3de328ad09aea7556a5e3456f0a7b6
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a50e7de15d9bfd33af7a0b51b9fe2ad041017bc3f3f5b7043728a55a260fc488
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 171136315103014BC3509F3EBD8885EBBF9FF82322F244635F859E6140EB34D45A8762
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050D87C0 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(?), ref: 050D87D0
                                                                                                                                                                                                                        • PyTuple_New.PYTHON3(?), ref: 050D87DF
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(?), ref: 050D8807
                                                                                                                                                                                                                        • PyTuple_SetItem.PYTHON3(00000000,00000000,00000000), ref: 050D8817
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: FromLongLong_Tuple_$Item
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 743308856-0
                                                                                                                                                                                                                        • Opcode ID: 1e14bc8b7d2c788ab81444d5f829a484f6a67c4d930fddc229ad00fb97e4f663
                                                                                                                                                                                                                        • Instruction ID: 5fb39a2b65e7226f990e7f9aa5313351ed681e3034901a8b0e6552a37791cf51
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1e14bc8b7d2c788ab81444d5f829a484f6a67c4d930fddc229ad00fb97e4f663
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1901A1B66042018BC6108F99FC89D6FBBE9FF81761F244135F81697251EB26D81A8762
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050D8670 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyFloat_FromDouble.PYTHON3 ref: 050D868A
                                                                                                                                                                                                                        • PyTuple_New.PYTHON3(?), ref: 050D8698
                                                                                                                                                                                                                        • PyFloat_FromDouble.PYTHON3 ref: 050D86C1
                                                                                                                                                                                                                        • PyTuple_SetItem.PYTHON3(00000000,00000000,00000000), ref: 050D86D1
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: DoubleFloat_FromTuple_$Item
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3480476165-0
                                                                                                                                                                                                                        • Opcode ID: eceb75f864ab313e0bf2b91f3c3ee05ed6bc45f051f00b7e6703ed8def79d6bc
                                                                                                                                                                                                                        • Instruction ID: 53fe7f9c9ae0e9cd64cf97192967b3b50138e065edef69014316bfbd5ecafb1f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: eceb75f864ab313e0bf2b91f3c3ee05ed6bc45f051f00b7e6703ed8def79d6bc
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D411AC756047018BC3109F3CBC8995FBBE9FF82622F144625F94ADA240EF32D45A87A2
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040EA58 Relevance: 7.5, APIs: 5, Instructions: 35COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: wcstombs$freereallocsetlocale
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3931877334-0
                                                                                                                                                                                                                        • Opcode ID: 1b61a0e1aaeda8027505282be700259d65b027cda1d85ed728b5ca162101692f
                                                                                                                                                                                                                        • Instruction ID: e696c5700d6393410b77d795bc353bc03d311abb2f38c8898df76e4b882a8a07
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1b61a0e1aaeda8027505282be700259d65b027cda1d85ed728b5ca162101692f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7C01D6B19093159FCB00AF65D64529EFBF0FF44344F12886EE488A7251E3789985CBCA
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040E887 Relevance: 7.5, APIs: 5, Instructions: 31COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: wcstombs$freereallocsetlocale
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3931877334-0
                                                                                                                                                                                                                        • Opcode ID: b9a3e2769ecb59adbd2afba563b8b068b0a70107dd94f56d983b6df17b883f0b
                                                                                                                                                                                                                        • Instruction ID: 3383cd8d3157cb3ed617c2d5b5c50993071427c57053a183d1f18b1378754ef2
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b9a3e2769ecb59adbd2afba563b8b068b0a70107dd94f56d983b6df17b883f0b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3DF0ECB19093009FCB40AF69D44529EFBE0EF84344F02CD6EE4D897211E7789895CB86
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040807B Relevance: 7.5, APIs: 5, Instructions: 26fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: clearerrfcloseferror$feoffreadfwrite
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2607417955-0
                                                                                                                                                                                                                        • Opcode ID: 66c0c2ea02a2b8e64ab6b9e82169b908f71de578d98de76c2dec7fdd32821baf
                                                                                                                                                                                                                        • Instruction ID: 6caf015234ffb0fe8031e1673ea91487ed83400b7f12cc8799a42872fabf3f27
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 66c0c2ea02a2b8e64ab6b9e82169b908f71de578d98de76c2dec7fdd32821baf
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D3E0AC71609B104AD3107F26A58116EF6E4AF80354F07492FE8E497291D77DC4C58B86
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05092630 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 123COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ??0QDragMoveEvent@@QAE@ABVQPoint@@V?$QFlags@W4DropAction@Qt@@@@PBVQMimeData@@V?$QFlags@W4MouseButton@Qt@@@@V?$QFlags@W4KeyboardModifier@Qt@@@@W4Type@QEvent@@@Z.QT5GUI(?,?,?,?,?,?), ref: 0509270C
                                                                                                                                                                                                                        • ??0QDragMoveEvent@@QAE@ABV0@@Z.QT5GUI(?), ref: 050927BB
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Flags@Qt@@@@$DragEvent@@Move$Action@Button@Data@@DropEvent@@@KeyboardMimeModifier@MousePoint@@Type@V0@@malloc
                                                                                                                                                                                                                        • String ID: =$J9J1J8J1J1|E
                                                                                                                                                                                                                        • API String ID: 2814225118-3265150092
                                                                                                                                                                                                                        • Opcode ID: 70b31e8f2b5dbe588aa1bb43c214de3054c0362868ffd280beb04ab170ef3372
                                                                                                                                                                                                                        • Instruction ID: d6aa6a18e321c30d116081214704b98acbbdbfc536ce503c9bb30bca5f35fc07
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 70b31e8f2b5dbe588aa1bb43c214de3054c0362868ffd280beb04ab170ef3372
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 69411A75118201AFDB11CF95DD81EABBFFAFB88314F044429F98493260DB32E9A4DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FE2585 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 109COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?remove@?$QVector@VQPointF@@@@QAEXH@Z.QT5CORE(00000000,?,?,?,?,?,?), ref: 04FE25FE
                                                                                                                                                                                                                        • ?remove@?$QVector@VQPointF@@@@QAEXH@Z.QT5CORE(?), ref: 04FE2683
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?remove@?$F@@@@PointVector@
                                                                                                                                                                                                                        • String ID: QPolygonF$__delitem__
                                                                                                                                                                                                                        • API String ID: 1048307195-783516681
                                                                                                                                                                                                                        • Opcode ID: 04a9457dcb625ff2a17de621377f1e3414837f3ba4a35849dbbd0a3e0b4d8241
                                                                                                                                                                                                                        • Instruction ID: a3a7191a890fcdd3ef222c5722623fbbc64130d4096da28938a0e920455e7f20
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 04a9457dcb625ff2a17de621377f1e3414837f3ba4a35849dbbd0a3e0b4d8241
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0F31B531204202AFD701DFA9DD81DAA7BE8FF88311F454559F958D7260E734ED4ACB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050846C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 109COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyType_IsSubtype.PYTHON3(?,057B5408), ref: 050846D8
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(?), ref: 050847F7
                                                                                                                                                                                                                        • PyErr_Clear.PYTHON3 ref: 0508480C
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ClearDeallocErr_SubtypeType_
                                                                                                                                                                                                                        • String ID: 1J9
                                                                                                                                                                                                                        • API String ID: 3120778283-2407233842
                                                                                                                                                                                                                        • Opcode ID: df4512a3857ce5b09af2493fa6469d4369425663332778741e7754eef1b5dff5
                                                                                                                                                                                                                        • Instruction ID: 8bb54cb0df1de61e40d00e9f39a5e374d66b660e7be824f8c42f4807fc18628c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: df4512a3857ce5b09af2493fa6469d4369425663332778741e7754eef1b5dff5
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 56416E71510B429FC725CF2AE48092AF7F0FF883157188B19E496A75A1EB70F499DF50
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05076620 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyType_IsSubtype.PYTHON3(?,057B2DB8), ref: 05076638
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(?), ref: 05076726
                                                                                                                                                                                                                        • PyErr_Clear.PYTHON3 ref: 0507673B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ClearDeallocErr_SubtypeType_
                                                                                                                                                                                                                        • String ID: 1J9
                                                                                                                                                                                                                        • API String ID: 3120778283-2407233842
                                                                                                                                                                                                                        • Opcode ID: 2d2b51122eb87e9666532a65eefa1547665971d0e0054969d12d717b31f4b980
                                                                                                                                                                                                                        • Instruction ID: dee1782397d4cd9223106958188b40bbfd427528c73649b98d1c7b4970149522
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2d2b51122eb87e9666532a65eefa1547665971d0e0054969d12d717b31f4b980
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: EF417B716146059FC314CF2AE884929F7F0BF88325B288B59F416A72A0EB71F495DF50
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050927E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 97COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ??0QOpenGLWindow@@QAE@W4UpdateBehavior@0@PAVQWindow@@@Z.QT5GUI(?,?), ref: 05092853
                                                                                                                                                                                                                        • ??0QOpenGLWindow@@QAE@PAVQOpenGLContext@@W4UpdateBehavior@0@PAVQWindow@@@Z.QT5GUI(?,?,?), ref: 0509290A
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Open$Behavior@0@UpdateWindow@@Window@@@$Context@@malloc
                                                                                                                                                                                                                        • String ID: J8|EJH$|EJH
                                                                                                                                                                                                                        • API String ID: 1102903694-1102502867
                                                                                                                                                                                                                        • Opcode ID: fb0b24d1405a50f5dac1f948752c9b8c5a5518cdc79079851a2fe13a35946311
                                                                                                                                                                                                                        • Instruction ID: 5348364a25d10091bbc93d1439290efb110f75ee3d675b8806940803e464eacd
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: fb0b24d1405a50f5dac1f948752c9b8c5a5518cdc79079851a2fe13a35946311
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F1419D70519352ABDB10CF54DA00B9BBBF1FF98704F40891CF98992260E776E998DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05072440 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyFloat_FromDouble.PYTHON3 ref: 050724D1
                                                                                                                                                                                                                        • PyUnicode_FromFormat.PYTHON3(PyQt5.QtGui.QMatrix2x2(%R, %R, %R, %R),?,?,?,?), ref: 05072508
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(?), ref: 05072539
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • PyQt5.QtGui.QMatrix2x2(%R, %R, %R, %R), xrefs: 05072503
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: From$DeallocDoubleFloat_FormatUnicode_
                                                                                                                                                                                                                        • String ID: PyQt5.QtGui.QMatrix2x2(%R, %R, %R, %R)
                                                                                                                                                                                                                        • API String ID: 2794734315-2417067665
                                                                                                                                                                                                                        • Opcode ID: 3078f9101ccc21c729b6934dace91fe682006c8ddcf2ab21e131c5cdfecefa45
                                                                                                                                                                                                                        • Instruction ID: 5d8c1d901bbec58ceb8f632b0377018ce2373c43d064fa7b892fe0016aae8fa2
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3078f9101ccc21c729b6934dace91fe682006c8ddcf2ab21e131c5cdfecefa45
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1C31F432A043059FC710DB7AE89585EF7E1FF8D218F855729F849A71A0E730E8958B81
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0507C4E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyFloat_FromDouble.PYTHON3 ref: 0507C551
                                                                                                                                                                                                                        • PyUnicode_FromFormat.PYTHON3(PyQt5.QtGui.QMatrix2x4(%R, %R, %R, %R, %R, %R, %R, %R),?,?,?,?,?,?,?,?), ref: 0507C598
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(?), ref: 0507C5C9
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • PyQt5.QtGui.QMatrix2x4(%R, %R, %R, %R, %R, %R, %R, %R), xrefs: 0507C593
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: From$DeallocDoubleFloat_FormatUnicode_
                                                                                                                                                                                                                        • String ID: PyQt5.QtGui.QMatrix2x4(%R, %R, %R, %R, %R, %R, %R, %R)
                                                                                                                                                                                                                        • API String ID: 2794734315-958969716
                                                                                                                                                                                                                        • Opcode ID: 182a78f51e9b0f063007bddae8be13cc4f7355fd3d85a97535ba4c5969769dd0
                                                                                                                                                                                                                        • Instruction ID: 3c8ec9bb33e2fbd7d6ec73187c78fc4c6c3c4868a318faa68184b4620cc45234
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 182a78f51e9b0f063007bddae8be13cc4f7355fd3d85a97535ba4c5969769dd0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 04213A32B047044FD710AF7CF8498AEB7D1BF89215F510639F856C7250EA61DD858B91
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0508A640 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyType_IsSubtype.PYTHON3(?,057B55F8), ref: 0508A658
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(?), ref: 0508A711
                                                                                                                                                                                                                        • PyErr_Clear.PYTHON3 ref: 0508A726
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ClearDeallocErr_SubtypeType_
                                                                                                                                                                                                                        • String ID: 1J9
                                                                                                                                                                                                                        • API String ID: 3120778283-2407233842
                                                                                                                                                                                                                        • Opcode ID: b959ed6d6b854fc70a509d7effa65efc9f49292419ab8d58ec6979043edfcaa1
                                                                                                                                                                                                                        • Instruction ID: c5c74104589335005b723f9cf0c1c1162f329b30643f6766301986b72d081162
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b959ed6d6b854fc70a509d7effa65efc9f49292419ab8d58ec6979043edfcaa1
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9931B0713042018FD714DF28E945E39B7F6FB88321B24462AF89AC7691EB31E896DB10
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05064430 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 79COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?drawTiledPixmap@QPaintEngine@@UAEXABVQRectF@@ABVQPixmap@@ABVQPointF@@@Z.QT5GUI(?,?,?), ref: 05064471
                                                                                                                                                                                                                        • ??0QPixmap@@QAE@ABV0@@Z.QT5GUI(?), ref: 050644B6
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Pixmap@@$?drawEngine@@F@@@PaintPixmap@PointRectTiledV0@@
                                                                                                                                                                                                                        • String ID: NNN$drawTiledPixmap
                                                                                                                                                                                                                        • API String ID: 245502091-3720221948
                                                                                                                                                                                                                        • Opcode ID: 26695a6ca8b4c451bf28745544ad849f0273895283a5f2fee5f4f31cfe75748a
                                                                                                                                                                                                                        • Instruction ID: 90a4cfbb23f6175e53731e2cbe03a87680c5c3040d7de1bd55257d0a7eba1ded
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 26695a6ca8b4c451bf28745544ad849f0273895283a5f2fee5f4f31cfe75748a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: EB21E632644300AFD3118F54EC41FABBBF5FB98714F004558FA4857161EB72A994CB61
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0507A460 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ??8@YA_NABVQCursor@@0@Z.QT5GUI(00000000,?), ref: 0507A4D2
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(00000000), ref: 0507A4F7
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ??8@Bool_Cursor@@0@FromLong
                                                                                                                                                                                                                        • String ID: 1J1
                                                                                                                                                                                                                        • API String ID: 1933976336-2174808320
                                                                                                                                                                                                                        • Opcode ID: 34aa1617c938465fb6e3528bea0d105c80cf6e6792fa9ef4237d4df405f5495b
                                                                                                                                                                                                                        • Instruction ID: 27c41297a9d7dbb166e3ff2b661de04ae87c2b609c12fb4bf0ee33b35630837d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 34aa1617c938465fb6e3528bea0d105c80cf6e6792fa9ef4237d4df405f5495b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9C21F8B1604205AFDB11CFA8FC85E6E7BE5FBC4315F444828F85487290DB36D95ACB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050005D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(00000001), ref: 05000646
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Bool_FromLong
                                                                                                                                                                                                                        • String ID: 1J9
                                                                                                                                                                                                                        • API String ID: 2610644205-2407233842
                                                                                                                                                                                                                        • Opcode ID: 52622e8dcbd42f26732c3040f8d609c9dd3c95b2e812ce19e8306919d23904a7
                                                                                                                                                                                                                        • Instruction ID: f927d7246e40160f4bf92a8e8ea94588a48724503795856d21082db46aee6268
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 52622e8dcbd42f26732c3040f8d609c9dd3c95b2e812ce19e8306919d23904a7
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 37213D711141009FDF10DF68FC49EAA3BE2BF84715F984564F448C7290DB3AE958CB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05096420 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050687C0: PyType_GetFlags.PYTHON3(?), ref: 050687CB
                                                                                                                                                                                                                          • Part of subcall function 050687C0: PyArg_ParseTuple.PYTHON3(?,0510B4E0,?,?), ref: 050687EF
                                                                                                                                                                                                                        • PyFloat_FromDouble.PYTHON3 ref: 050964B2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Arg_DoubleFlagsFloat_FromParseTupleType_
                                                                                                                                                                                                                        • String ID: 1P0$QMatrix4x3$__getitem__
                                                                                                                                                                                                                        • API String ID: 452299487-117433
                                                                                                                                                                                                                        • Opcode ID: 58394df0bc6c823b34908984f8301a8218e89d89c25ac38c80fe1c0d0ce672dd
                                                                                                                                                                                                                        • Instruction ID: 565eeac871d57d06d93953e74c93244aca1f98d4ca5d65da71a4f4744b9fdf51
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 58394df0bc6c823b34908984f8301a8218e89d89c25ac38c80fe1c0d0ce672dd
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E921DE70508201AFDB11DFA8ED42EAA7BE4BF84301F444878F949D7261EB35E9588B82
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05090790 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 70COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050687C0: PyType_GetFlags.PYTHON3(?), ref: 050687CB
                                                                                                                                                                                                                          • Part of subcall function 050687C0: PyArg_ParseTuple.PYTHON3(?,0510B4E0,?,?), ref: 050687EF
                                                                                                                                                                                                                        • PyFloat_FromDouble.PYTHON3 ref: 05090820
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Arg_DoubleFlagsFloat_FromParseTupleType_
                                                                                                                                                                                                                        • String ID: 1P0$QMatrix4x2$__getitem__
                                                                                                                                                                                                                        • API String ID: 452299487-3717665596
                                                                                                                                                                                                                        • Opcode ID: dad4d8b5d7e8f6d96afab68e1970707fe94f96fbd65cb793c7b5c96ffbbe4bec
                                                                                                                                                                                                                        • Instruction ID: 72a910ff496344149399b7d1ed3c046f51ad0bbe47a097f42d8a2015ce917002
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: dad4d8b5d7e8f6d96afab68e1970707fe94f96fbd65cb793c7b5c96ffbbe4bec
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0821AF30614201AFE711DBA8EC46FAA77E4BB84701F444869F988D7261E731E958CB92
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FF45B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ??H?$QVector@VQPoint@@@@QBE?AV0@ABV0@@Z.QT5CORE(?,?), ref: 04FF4626
                                                                                                                                                                                                                        • ??0QPolygon@@QAE@$$QAV0@@Z.QT5GUI(00000000), ref: 04FF462F
                                                                                                                                                                                                                        • ??1?$QVector@VQPoint@@@@QAE@XZ.QT5CORE ref: 04FF463B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Point@@@@V0@@Vector@$??1?$E@$$Polygon@@malloc
                                                                                                                                                                                                                        • String ID: 1J9
                                                                                                                                                                                                                        • API String ID: 2872870447-2407233842
                                                                                                                                                                                                                        • Opcode ID: fdf65fa99e8662a8cffcf484b2ce0369c34eea4ba2ef4c6b669c5da9cba0acdf
                                                                                                                                                                                                                        • Instruction ID: 00efe8ca9ab406006bfaf041863202fd79f7b457df162572772b3e7278b17746
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: fdf65fa99e8662a8cffcf484b2ce0369c34eea4ba2ef4c6b669c5da9cba0acdf
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 99117236614201AFEB01DFE4EC45E9A7BE5FF88310F044464FE18C3250DB39AA5ACB92
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FF84E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?isCopyOf@QTextCursor@@QBE_NABV1@@Z.QT5GUI(?), ref: 04FF8544
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(00000000), ref: 04FF8552
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Bool_CopyCursor@@FromLongTextV1@@
                                                                                                                                                                                                                        • String ID: 1J9
                                                                                                                                                                                                                        • API String ID: 1629049401-2407233842
                                                                                                                                                                                                                        • Opcode ID: 7c2197acd7e62682f533af687fdc013e90c8c7a4e676db2bd5641eee3cb51dc0
                                                                                                                                                                                                                        • Instruction ID: 31e53bb59133e310a2a691126671fb5c84961ebdff594050353a7ef9cb1da055
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7c2197acd7e62682f533af687fdc013e90c8c7a4e676db2bd5641eee3cb51dc0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: AE115971500200AFCF11EF68EC0699E3FE1BF84725F4C0528F849972A0EB35EA5ACB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05078540 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64windowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ??8QOpenGLDebugMessage@@QBE_NABV0@@Z.QT5GUI(?), ref: 050785A4
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(00000000), ref: 050785B2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Bool_DebugFromLongMessage@@OpenV0@@
                                                                                                                                                                                                                        • String ID: 1J9
                                                                                                                                                                                                                        • API String ID: 4032669193-2407233842
                                                                                                                                                                                                                        • Opcode ID: 09567210146cb45aa0a57bb1d9fc6b153d0745e6293401870a4320221293ffa4
                                                                                                                                                                                                                        • Instruction ID: f9e4fe5be347cc7a487b848ba0a190226d2dd3f7bc45d7e7a09d44712d7de93d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 09567210146cb45aa0a57bb1d9fc6b153d0745e6293401870a4320221293ffa4
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 09115C71500200AFCB11DF68FC1AD5E3BE1BF44711F484568F849872A0EB35DA59CB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05048700 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ??8QTextFormat@@QBE_NABV0@@Z.QT5GUI(?), ref: 05048764
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(00000000), ref: 05048772
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Bool_Format@@FromLongTextV0@@
                                                                                                                                                                                                                        • String ID: 1J9
                                                                                                                                                                                                                        • API String ID: 3920592147-2407233842
                                                                                                                                                                                                                        • Opcode ID: e75e3b20127c52097fd7ce4f65a7712f5c20586015a96da4fcb0f3ef6e6f0015
                                                                                                                                                                                                                        • Instruction ID: f67174b76860f469262d2861f5a0e273752a6b6ef9c19cfc71c371a3e6739f00
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e75e3b20127c52097fd7ce4f65a7712f5c20586015a96da4fcb0f3ef6e6f0015
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C2116A712102009FCB119F68FD46DAE3BE0BF84320F084438F848D72A0E735D958DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0504E400 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ??9QTextLength@@QBE_NABV0@@Z.QT5GUI(?), ref: 0504E464
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 0504E46E
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Bool_FromLength@@LongTextV0@@
                                                                                                                                                                                                                        • String ID: 1J9
                                                                                                                                                                                                                        • API String ID: 810943551-2407233842
                                                                                                                                                                                                                        • Opcode ID: fac812c3ff376eeaf00bf2a5207c76b7f23e284181313d9f5320d3f8bbc1dae9
                                                                                                                                                                                                                        • Instruction ID: 4a4fecd683e8bab679e4b78e5ff123bf840ac88104b69a8976a6079e53b8b722
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: fac812c3ff376eeaf00bf2a5207c76b7f23e284181313d9f5320d3f8bbc1dae9
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9F11D6B1104200AFCA119BA8FC46DAF3FE5BF84721F484564FC49962A0E735D959DB53
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05094710 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ??8QGradient@@QBE_NABV0@@Z.QT5GUI(?), ref: 05094774
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 0509477E
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Bool_FromGradient@@LongV0@@
                                                                                                                                                                                                                        • String ID: 1J9
                                                                                                                                                                                                                        • API String ID: 1012961388-2407233842
                                                                                                                                                                                                                        • Opcode ID: 12d99a41a44e1fd3fa7a0bd2d9beffaca9053809369a9946cf05b6cf2fc92906
                                                                                                                                                                                                                        • Instruction ID: 6c899cec2493b784cdc682ad312d1502581888f101189c18de2ec8d88ed8dd9f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 12d99a41a44e1fd3fa7a0bd2d9beffaca9053809369a9946cf05b6cf2fc92906
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F4113675110200AFDE21AFACFD46DAE3BE1BF84721F480424F849862A0EB35D959DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0500E720 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ??NQTextCursor@@QBE_NABV0@@Z.QT5GUI(?), ref: 0500E784
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 0500E78E
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Bool_Cursor@@FromLongTextV0@@
                                                                                                                                                                                                                        • String ID: 1J9
                                                                                                                                                                                                                        • API String ID: 4057910976-2407233842
                                                                                                                                                                                                                        • Opcode ID: 2f9822ecc1f5a5d521fd50d7e85661e6741635648814090fd9405eed0cc252bd
                                                                                                                                                                                                                        • Instruction ID: 96390706c29818ada5c54d2c09a34b028be7b81a5120780bdb4c36f80db8f9ea
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2f9822ecc1f5a5d521fd50d7e85661e6741635648814090fd9405eed0cc252bd
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D711E471104200AFDA119BA8FD46ABE3FE5BF84715F480428F84D962E0D735D959CB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0502C770 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ??8@YA_NABVQSurfaceFormat@@0@Z.QT5GUI(00000000,?), ref: 0502C7D3
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 0502C7DD
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ??8@Bool_Format@@0@FromLongSurface
                                                                                                                                                                                                                        • String ID: 1J9
                                                                                                                                                                                                                        • API String ID: 618732770-2407233842
                                                                                                                                                                                                                        • Opcode ID: 7db2d6d9d1c0c85397a9350a01dbccdb544e0e31399084229d46356b8a269975
                                                                                                                                                                                                                        • Instruction ID: 9438915ddd19e2ac21368182a03423c9d28d2de5963e1f9bf5327eab2a8aa018
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7db2d6d9d1c0c85397a9350a01dbccdb544e0e31399084229d46356b8a269975
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9F110671514201BFDB119FA8FC46DAE3BE1BF84711F444464F858862A0EB36D959CB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05078780 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62windowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ??8QOpenGLDebugMessage@@QBE_NABV0@@Z.QT5GUI(?), ref: 050787E4
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 050787EE
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Bool_DebugFromLongMessage@@OpenV0@@
                                                                                                                                                                                                                        • String ID: 1J9
                                                                                                                                                                                                                        • API String ID: 4032669193-2407233842
                                                                                                                                                                                                                        • Opcode ID: c0ebfac9838863be738985b4e7d4d8f0b50997b4526c7ab462806b2837739f6b
                                                                                                                                                                                                                        • Instruction ID: 81f758b14b86cfb8a82793bdac9b7f3a94cbec715077608ab465b7a8a5705ec2
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c0ebfac9838863be738985b4e7d4d8f0b50997b4526c7ab462806b2837739f6b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B5117F31500204AFCB51DF68FD49D6E3FE1BF84711F484568F84997290DB35D959CB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0504E610 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ??9QPainterPath@@QBE_NABV0@@Z.QT5GUI(?), ref: 0504E674
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 0504E67E
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Bool_FromLongPainterPath@@V0@@
                                                                                                                                                                                                                        • String ID: 1J9
                                                                                                                                                                                                                        • API String ID: 756399302-2407233842
                                                                                                                                                                                                                        • Opcode ID: 683a515cf5397c533a7adc0c6cb16f95fd0b2f15ee88bd278eb29db0b8ada741
                                                                                                                                                                                                                        • Instruction ID: 15c5a3e0d5bc8b83bf85714b59deb45436977d65c31aba03e521024a59dd34a7
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 683a515cf5397c533a7adc0c6cb16f95fd0b2f15ee88bd278eb29db0b8ada741
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: ED110671504200AFCB119FA8FD06D6A3BE5BF84725F480478F849962A0EB35D959CB53
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0509A690 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ??8QMatrix4x4@@QBE_NABV0@@Z.QT5GUI(?), ref: 0509A6F4
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?), ref: 0509A6FE
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Bool_FromLongMatrix4x4@@V0@@
                                                                                                                                                                                                                        • String ID: 1J9
                                                                                                                                                                                                                        • API String ID: 2177095239-2407233842
                                                                                                                                                                                                                        • Opcode ID: 8c81bd0a097c46e24ae4624a4b21aadce82cf925851885e993e92b8fe0359c20
                                                                                                                                                                                                                        • Instruction ID: f0a79f7ea2358a14ae5e3c24517746003890ef015918a4e500d60982ded1f043
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8c81bd0a097c46e24ae4624a4b21aadce82cf925851885e993e92b8fe0359c20
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D7115C75204200AFCF119F68FC46D6E3FE1BF84725F484524FC49822A0D735D958DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0500E5D0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 60COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?focusObject@QWindow@@UBEPAVQObject@@XZ.QT5GUI ref: 0500E639
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?focusObject@Object@@Window@@
                                                                                                                                                                                                                        • String ID: QWindow$focusObject$focusObject(self) -> Optional[QObject]
                                                                                                                                                                                                                        • API String ID: 268306031-3493841502
                                                                                                                                                                                                                        • Opcode ID: 14bd7a7501ca3fb19b2a9075c4a609dff838f869efcf46c90f8ca522d0ba6619
                                                                                                                                                                                                                        • Instruction ID: feacd3d8283f638cd288848b5126ccf1a057935f6bece9dd8c01fb892c2a0fdb
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 14bd7a7501ca3fb19b2a9075c4a609dff838f869efcf46c90f8ca522d0ba6619
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F71194302542019FE700DBA4FD46E6A37E9FB44701F484465FD08D7690E675ED99DB22
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05050530 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 55COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?worldTransform@QPainter@@QBEABVQTransform@@XZ.QT5GUI ref: 0505057D
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?worldPainter@@Transform@Transform@@malloc
                                                                                                                                                                                                                        • String ID: QPainter$worldTransform$worldTransform(self) -> QTransform
                                                                                                                                                                                                                        • API String ID: 2443361289-1684972711
                                                                                                                                                                                                                        • Opcode ID: 3afd71aa739a1e1e4735de3369859be65d4f5469135e61601c8e27ef5bf081e4
                                                                                                                                                                                                                        • Instruction ID: f02c8cb41344caff37c21e119ace1c34a8553240b4a633487e30afd481ad2489
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3afd71aa739a1e1e4735de3369859be65d4f5469135e61601c8e27ef5bf081e4
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9C11E4309187419BE601DF78DD02EA677E0BF98304F059654FE8896162FB74BAD8C751
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050687C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyType_GetFlags.PYTHON3(?), ref: 050687CB
                                                                                                                                                                                                                        • PyArg_ParseTuple.PYTHON3(?,0510B4E0,?,?), ref: 050687EF
                                                                                                                                                                                                                        • PyErr_Format.PYTHON3(6CFCA174,an index must be a row in the range 0 to %d and a column in the range 0 to %d,?,?), ref: 05068830
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • an index must be a row in the range 0 to %d and a column in the range 0 to %d, xrefs: 05068829
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Arg_Err_FlagsFormatParseTupleType_
                                                                                                                                                                                                                        • String ID: an index must be a row in the range 0 to %d and a column in the range 0 to %d
                                                                                                                                                                                                                        • API String ID: 2941527345-3448741815
                                                                                                                                                                                                                        • Opcode ID: 4e918fb75a98cbaa08740fa716f53f757b2922c1cfba5111a06f886264941d13
                                                                                                                                                                                                                        • Instruction ID: 9d7e4a0d34cbe57dea47308ee6be2be9b7faf37e525adcc90ece38d164ae4e65
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4e918fb75a98cbaa08740fa716f53f757b2922c1cfba5111a06f886264941d13
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2C01CC712082019FE7108B49FC89E6E7BE8EF84608F14886DF681D7201CB22E9268B21
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05080730 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 52COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?fromIccProfile@QColorSpace@@SA?AV1@ABVQByteArray@@@Z.QT5GUI(00000000,?,00000004), ref: 05080781
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • fromIccProfile(iccProfile: Union[QByteArray, bytes, bytearray]) -> QColorSpace, xrefs: 050807C2
                                                                                                                                                                                                                        • QColorSpace, xrefs: 050807CC
                                                                                                                                                                                                                        • fromIccProfile, xrefs: 050807C7
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?fromArray@@@ByteColorProfile@Space@@malloc
                                                                                                                                                                                                                        • String ID: QColorSpace$fromIccProfile$fromIccProfile(iccProfile: Union[QByteArray, bytes, bytearray]) -> QColorSpace
                                                                                                                                                                                                                        • API String ID: 1519831675-1176317966
                                                                                                                                                                                                                        • Opcode ID: 529c7fa2e53646e960342c221f48b32ece28c845c6e263948c2f8d404821ca2c
                                                                                                                                                                                                                        • Instruction ID: 23bc4f287178f2c2d8113a6130e7878dfa17a899aaf33c2c4adac4efb2bcebe4
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 529c7fa2e53646e960342c221f48b32ece28c845c6e263948c2f8d404821ca2c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2D110631108201AFD701DFA4ED46FAA7BE5FB88300F044414FE48933A0D775AD99DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0501C5E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 49COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?format@QSyntaxHighlighter@@IBE?AVQTextCharFormat@@H@Z.QT5GUI(00000000,?), ref: 0501C637
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?format@CharFormat@@Highlighter@@SyntaxTextmalloc
                                                                                                                                                                                                                        • String ID: QSyntaxHighlighter$format$format(self, pos: int) -> QTextCharFormat
                                                                                                                                                                                                                        • API String ID: 648193224-1897865735
                                                                                                                                                                                                                        • Opcode ID: 995975b0de35cba6dc1126a4b7cf85c0b409ca3bbb95d2c67f5dbdef03bb7361
                                                                                                                                                                                                                        • Instruction ID: 3298bc807dc9df9e7541fb286bba3ea23f1e1f2e88e32b733f8c29de630b639f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 995975b0de35cba6dc1126a4b7cf85c0b409ca3bbb95d2c67f5dbdef03bb7361
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: AB018431254201AFD701DB94EC42EAA7BE8FF84210F044465FD48C7260D675AA99DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05058700 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 47COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?rect@QPageSize@@QBE?AVQRectF@@W4Unit@1@@Z.QT5GUI(00000000,?), ref: 0505875A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?rect@PageRectSize@@Unit@1@@malloc
                                                                                                                                                                                                                        • String ID: QPageSize$rect$rect(self, units: QPageSize.Unit) -> QRectF
                                                                                                                                                                                                                        • API String ID: 1657382084-3066035369
                                                                                                                                                                                                                        • Opcode ID: e625dfc1ad1d74c4b3c4864911add1201ae4f019ef78e78f43e1ee02711d2277
                                                                                                                                                                                                                        • Instruction ID: 51d57707858e3ddc7bc1ca8fcb633ead36efd2f78e458d6787ccf4bc5ef4bda6
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e625dfc1ad1d74c4b3c4864911add1201ae4f019ef78e78f43e1ee02711d2277
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6701C430214201AFE701DBA4EC42FAA7BE9FB48700F044424FE48C3290D6B5EA99DB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05036630 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 47COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?property@QTextFormat@@QBE?AVQVariant@@H@Z.QT5GUI(00000000,00001FE7), ref: 05036683
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?property@Format@@TextVariant@@malloc
                                                                                                                                                                                                                        • String ID: QTextCharFormat$fontFamilies$fontFamilies(self) -> Any
                                                                                                                                                                                                                        • API String ID: 3525565995-3369884772
                                                                                                                                                                                                                        • Opcode ID: 6f84880bf5731c3a2d0f0cfa966cf87503093c7d2375460ad21d5563f64d0ae8
                                                                                                                                                                                                                        • Instruction ID: f7dd7d23efab96a2f828ed1c15c6f320330e82da08969b01dcbc1125344b320d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6f84880bf5731c3a2d0f0cfa966cf87503093c7d2375460ad21d5563f64d0ae8
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B901B130254201AFEB01EBA4EC42EAE7BE4FF84711F040420F948D7250D7B9AD99DBA2
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FE24E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 46COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?marginsPixels@QPageLayout@@QBE?AVQMargins@@H@Z.QT5GUI(00000000,?), ref: 04FE2534
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • marginsPixels, xrefs: 04FE255E
                                                                                                                                                                                                                        • marginsPixels(self, resolution: int) -> QMargins, xrefs: 04FE2559
                                                                                                                                                                                                                        • QPageLayout, xrefs: 04FE2563
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?marginsLayout@@Margins@@PagePixels@malloc
                                                                                                                                                                                                                        • String ID: QPageLayout$marginsPixels$marginsPixels(self, resolution: int) -> QMargins
                                                                                                                                                                                                                        • API String ID: 2089075139-2015662546
                                                                                                                                                                                                                        • Opcode ID: a9a49004e79bbf90f5f0d2ebec919aa253418e21cedd7cc7eb140584c29f3932
                                                                                                                                                                                                                        • Instruction ID: 556fa6b50871e18f77c9143d912d583d35c4dbb12bfa093853ac7bb672cf7148
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a9a49004e79bbf90f5f0d2ebec919aa253418e21cedd7cc7eb140584c29f3932
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5C01D270254201AFE701DF94EC02FAA7BE8BB88310F044425FD48C7260DAB5EE9DDB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FE85B0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 46COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?blockList@QTextBlockGroup@@IBE?AV?$QList@VQTextBlock@@@@XZ.QT5GUI(00000000), ref: 04FE85FE
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: List@Text$?blockBlockBlock@@@@Group@@malloc
                                                                                                                                                                                                                        • String ID: QTextBlockGroup$blockList$blockList(self) -> List[QTextBlock]
                                                                                                                                                                                                                        • API String ID: 532813319-1004373430
                                                                                                                                                                                                                        • Opcode ID: 988a9c4a7f833e171ae6efa98e51bb2ec72b2df94e1cc985e4f05c9879d1bc20
                                                                                                                                                                                                                        • Instruction ID: eb6c161f3a3b2908fed1121da271efbfc7a2eee142ed9295a377296aafa5d8e1
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 988a9c4a7f833e171ae6efa98e51bb2ec72b2df94e1cc985e4f05c9879d1bc20
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5C01F730244201AFDA01EFA4EC42EEA7BE8FF84711F444460FD48D7250E779AD99DBA2
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FFA650 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 46COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?lineAt@QTextLayout@@QBE?AVQTextLine@@H@Z.QT5GUI(00000000,?), ref: 04FFA6A4
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Text$?lineLayout@@Line@@malloc
                                                                                                                                                                                                                        • String ID: QTextLayout$lineAt$lineAt(self, i: int) -> QTextLine
                                                                                                                                                                                                                        • API String ID: 3784551423-616224910
                                                                                                                                                                                                                        • Opcode ID: 28e5199cd82f35fa4bed84970fb9168505c8d347b785ddfa03f2242c0ae015c3
                                                                                                                                                                                                                        • Instruction ID: 809eeedff455f2ae6bff2422ef21a247b03289b76837dc8cd5a39aa29ff3f62b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 28e5199cd82f35fa4bed84970fb9168505c8d347b785ddfa03f2242c0ae015c3
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3801B570654201AFDB01DFA4EC42F6A7BE8BB88700F448425F948C72A0D675EE99DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FFA760 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 46COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?findBlockByNumber@QTextDocument@@QBE?AVQTextBlock@@H@Z.QT5GUI(00000000,?), ref: 04FFA7B4
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • findBlockByNumber, xrefs: 04FFA7DE
                                                                                                                                                                                                                        • findBlockByNumber(self, blockNumber: int) -> QTextBlock, xrefs: 04FFA7D9
                                                                                                                                                                                                                        • QTextDocument, xrefs: 04FFA7E3
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Text$?findBlockBlock@@Document@@Number@malloc
                                                                                                                                                                                                                        • String ID: QTextDocument$findBlockByNumber$findBlockByNumber(self, blockNumber: int) -> QTextBlock
                                                                                                                                                                                                                        • API String ID: 4071994147-4255961804
                                                                                                                                                                                                                        • Opcode ID: 38d43824182887ba6a2dc0220405ea68a0e5d5ef824f536a5190f22f078e3691
                                                                                                                                                                                                                        • Instruction ID: 39a9d91b3e121126bf778c39e006153a4bc9d6ce661f63b37f86f65dc1491f13
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 38d43824182887ba6a2dc0220405ea68a0e5d5ef824f536a5190f22f078e3691
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B301F570644200AFDB01DBA4EC42FAA7BE8FB88300F044464FA48C3260D675EA99DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FFC4D0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 45COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?fromTranslate@QTransform@@SA?AV1@NN@Z.QT5GUI(00000000), ref: 04FFC528
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • QTransform, xrefs: 04FFC557
                                                                                                                                                                                                                        • fromTranslate(dx: float, dy: float) -> QTransform, xrefs: 04FFC54D
                                                                                                                                                                                                                        • fromTranslate, xrefs: 04FFC552
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?fromTransform@@Translate@malloc
                                                                                                                                                                                                                        • String ID: QTransform$fromTranslate$fromTranslate(dx: float, dy: float) -> QTransform
                                                                                                                                                                                                                        • API String ID: 3160360949-3903893780
                                                                                                                                                                                                                        • Opcode ID: 21d82d9a10a495bebf55146409c00abb27142ee22f5e981f1df6b45bb2675fc1
                                                                                                                                                                                                                        • Instruction ID: d016eb0c520c637d4ecfa708ea4cd6405962c97650fb414715d7ea2015b9a995
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 21d82d9a10a495bebf55146409c00abb27142ee22f5e981f1df6b45bb2675fc1
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E2012630514601AFD701EFB8DC42EAF77F8BF88700F444465F948DA121E774E9898B12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050965A0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 45COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?fill@QMatrix4x4@@QAEXM@Z.QT5GUI ref: 050965F1
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?fill@Matrix4x4@@
                                                                                                                                                                                                                        • String ID: QMatrix4x4$fill$fill(self, value: float)
                                                                                                                                                                                                                        • API String ID: 2893052341-390222504
                                                                                                                                                                                                                        • Opcode ID: 1b4733b5aa76acb8e3eafaeb67346678d7d28bb9d97c4f363c4ad56d4465dca3
                                                                                                                                                                                                                        • Instruction ID: 31ee2b795d0b6817694e480ac97b52fbe6d2629c853ffa6d4ba67a7ae948fadf
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1b4733b5aa76acb8e3eafaeb67346678d7d28bb9d97c4f363c4ad56d4465dca3
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F701B534214201AFD701DF64EC82E6ABBE4FB88710F444969FC59C73A0EB75A95ADB42
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0505C450 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 45COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setTop@QDoubleValidator@@QAEXN@Z.QT5GUI ref: 0505C4A3
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?setDoubleTop@Validator@@
                                                                                                                                                                                                                        • String ID: QDoubleValidator$setTop$setTop(self, a0: float)
                                                                                                                                                                                                                        • API String ID: 236495550-2298479482
                                                                                                                                                                                                                        • Opcode ID: 5a0320c892355e4d3723753aaf202f983eb8c8776349886eb200e72e0c8792e2
                                                                                                                                                                                                                        • Instruction ID: c59c1f8b9aeaa60288224f167d239000309ddd927dbf6d894d004c7cdd216fa8
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5a0320c892355e4d3723753aaf202f983eb8c8776349886eb200e72e0c8792e2
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5A016D34254201AFE341DFA8D842D6A7BE8FB48314F404999F85DD72A0EB799996CB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FFC7B0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 45COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?fromScale@QTransform@@SA?AV1@NN@Z.QT5GUI(00000000), ref: 04FFC808
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?fromScale@Transform@@malloc
                                                                                                                                                                                                                        • String ID: QTransform$fromScale$fromScale(dx: float, dy: float) -> QTransform
                                                                                                                                                                                                                        • API String ID: 3842683458-3728968616
                                                                                                                                                                                                                        • Opcode ID: 6f74c743f868d67482cfc600d32ee77076504803031e1688a1b96d9edb5416d2
                                                                                                                                                                                                                        • Instruction ID: 8e5b17f0e8be59f5674f5b0efbdccdc118725ebb0c1e501e371af83363f166b3
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6f74c743f868d67482cfc600d32ee77076504803031e1688a1b96d9edb5416d2
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 38012230954601AFD701EFA8DC42E9FBBE8FF88700F444464F9489B220EB74E9898B12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0505E5E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setOrientation@QPageLayout@@QAEXW4Orientation@1@@Z.QT5GUI(?), ref: 0505E62F
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • setOrientation(self, orientation: QPageLayout.Orientation), xrefs: 0505E658
                                                                                                                                                                                                                        • setOrientation, xrefs: 0505E65D
                                                                                                                                                                                                                        • QPageLayout, xrefs: 0505E662
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?setLayout@@Orientation@Orientation@1@@Page
                                                                                                                                                                                                                        • String ID: QPageLayout$setOrientation$setOrientation(self, orientation: QPageLayout.Orientation)
                                                                                                                                                                                                                        • API String ID: 1891949463-4195498082
                                                                                                                                                                                                                        • Opcode ID: a59488a167795ba88c45020c35d3f29eed23f20686cfccea755685092f7c8083
                                                                                                                                                                                                                        • Instruction ID: fcbecf4c013e31eb8bf9ce8e8edf6d114cb6e8ea857978b9fb5f0655b9013fbd
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a59488a167795ba88c45020c35d3f29eed23f20686cfccea755685092f7c8083
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8B018430214201AFD701DF54EC82E6A77E9FB48710F544969FD58C3390D7B59E5ADB42
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05044720 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setLayoutDirection@QPainter@@QAEXW4LayoutDirection@Qt@@@Z.QT5GUI(?), ref: 0504476F
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • setLayoutDirection(self, direction: Qt.LayoutDirection), xrefs: 05044798
                                                                                                                                                                                                                        • setLayoutDirection, xrefs: 0504479D
                                                                                                                                                                                                                        • QPainter, xrefs: 050447A2
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Direction@Layout$?setPainter@@Qt@@@
                                                                                                                                                                                                                        • String ID: QPainter$setLayoutDirection$setLayoutDirection(self, direction: Qt.LayoutDirection)
                                                                                                                                                                                                                        • API String ID: 3789420147-2654130438
                                                                                                                                                                                                                        • Opcode ID: 99113542d787a0bc38ba993c18042fac120ee7e335ef5942e370d8df4c07c747
                                                                                                                                                                                                                        • Instruction ID: c9c44bf95c23a506511388fcd7446785912caed3aeb9a740e61b1d98e60cb848
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 99113542d787a0bc38ba993c18042fac120ee7e335ef5942e370d8df4c07c747
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: EE01C070208201AFD740CF64EC82E7A7BE5FB48304F544828F858C33A0DB79AD5ADB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05004730 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?reportContentOrientationChange@QWindow@@QAEXW4ScreenOrientation@Qt@@@Z.QT5GUI(?), ref: 0500477F
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • reportContentOrientationChange(self, orientation: Qt.ScreenOrientation), xrefs: 050047A8
                                                                                                                                                                                                                        • QWindow, xrefs: 050047B2
                                                                                                                                                                                                                        • reportContentOrientationChange, xrefs: 050047AD
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?reportChange@ContentOrientationOrientation@Qt@@@ScreenWindow@@
                                                                                                                                                                                                                        • String ID: QWindow$reportContentOrientationChange$reportContentOrientationChange(self, orientation: Qt.ScreenOrientation)
                                                                                                                                                                                                                        • API String ID: 1215209452-1000199096
                                                                                                                                                                                                                        • Opcode ID: e509ff1b11bd13dcbd1fada80c02496cbdc599d3c0c57ecd2606f4163179e05e
                                                                                                                                                                                                                        • Instruction ID: f206f7cb26b8169f19cca6fc58b5898a103e492512ff61056be5ad116814b40a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e509ff1b11bd13dcbd1fada80c02496cbdc599d3c0c57ecd2606f4163179e05e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CB016D30214201AFD701DB54EC82E797BE5FB88710F544428FD5CD73A0DB75AA5ADB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05016730 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyLong_FromUnsignedLong.PYTHON3 ref: 0501678D
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: FromLongLong_Unsigned
                                                                                                                                                                                                                        • String ID: QRgba64$green8$green8(self) -> int
                                                                                                                                                                                                                        • API String ID: 3417993445-3714250278
                                                                                                                                                                                                                        • Opcode ID: 541c053044a8e1ffe3019ccbefbb7476ebfdc412e87d2a44c13f09ce2a0ef878
                                                                                                                                                                                                                        • Instruction ID: 4a09db360d9313f475477ac8eabad93d9379bf861295e0b0f7327672a6b5e4ff
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 541c053044a8e1ffe3019ccbefbb7476ebfdc412e87d2a44c13f09ce2a0ef878
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 91012470210201AFCB00EF78ED46E2A77E4FB84312F440468F845C7290D278ED58D762
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0503A730 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setTextFormat@QStaticText@@QAEXW4TextFormat@Qt@@@Z.QT5GUI(?), ref: 0503A77F
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • QStaticText, xrefs: 0503A7B2
                                                                                                                                                                                                                        • setTextFormat(self, textFormat: Qt.TextFormat), xrefs: 0503A7A8
                                                                                                                                                                                                                        • setTextFormat, xrefs: 0503A7AD
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Format@Text$?setQt@@@StaticText@@
                                                                                                                                                                                                                        • String ID: QStaticText$setTextFormat$setTextFormat(self, textFormat: Qt.TextFormat)
                                                                                                                                                                                                                        • API String ID: 2794307452-935631387
                                                                                                                                                                                                                        • Opcode ID: e38e9690e5d1c7b61a3ff7812636ed0dd5ef4b3f0501ffb33eb3896cf8313f32
                                                                                                                                                                                                                        • Instruction ID: 167033661fa0720f13263ebeb90cc90693b44cb17c2da7fb1a1b1461ce6f7b6d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e38e9690e5d1c7b61a3ff7812636ed0dd5ef4b3f0501ffb33eb3896cf8313f32
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A001C030204201AFD701CF64ED86E6A7BE9FB88700F044428FD59C3390DB799E5ADB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05052780 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setCheckState@QStandardItem@@QAEXW4CheckState@Qt@@@Z.QT5GUI(?), ref: 050527CF
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • setCheckState(self, acheckState: Qt.CheckState), xrefs: 050527F8
                                                                                                                                                                                                                        • setCheckState, xrefs: 050527FD
                                                                                                                                                                                                                        • QStandardItem, xrefs: 05052802
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CheckState@$?setItem@@Qt@@@Standard
                                                                                                                                                                                                                        • String ID: QStandardItem$setCheckState$setCheckState(self, acheckState: Qt.CheckState)
                                                                                                                                                                                                                        • API String ID: 985852455-1984897763
                                                                                                                                                                                                                        • Opcode ID: c7a75514e797f23f331be2d5129b985761d59dd648a770af4a5fd6b740311682
                                                                                                                                                                                                                        • Instruction ID: 8c3785d08a9ccf394dc44d402d329a2f5ce77676d49b81c1816491723fbd7b25
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c7a75514e797f23f331be2d5129b985761d59dd648a770af4a5fd6b740311682
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6F018434204206AFD701CF64ED82E6A77E9FB88710F144468FD58D3390DB75D956DB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050307E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setUnderlineStyle@QTextCharFormat@@QAEXW4UnderlineStyle@1@@Z.QT5GUI(?), ref: 0503082F
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • QTextCharFormat, xrefs: 05030862
                                                                                                                                                                                                                        • setUnderlineStyle(self, style: QTextCharFormat.UnderlineStyle), xrefs: 05030858
                                                                                                                                                                                                                        • setUnderlineStyle, xrefs: 0503085D
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Underline$?setCharFormat@@Style@Style@1@@Text
                                                                                                                                                                                                                        • String ID: QTextCharFormat$setUnderlineStyle$setUnderlineStyle(self, style: QTextCharFormat.UnderlineStyle)
                                                                                                                                                                                                                        • API String ID: 1182914909-3441956564
                                                                                                                                                                                                                        • Opcode ID: a1015be1b339730e2ff1645118f73f4679be8381fab027f513044e58a3aa27ff
                                                                                                                                                                                                                        • Instruction ID: da6d4c56b15ff0c5c7d92d22e0e9df8cf46ef14c1919b511d1827c39116abb5d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a1015be1b339730e2ff1645118f73f4679be8381fab027f513044e58a3aa27ff
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: DF018034214201AFD701DFA4EC86E6A7BE9FB88704F144428FD58D3390DB799A5ADB42
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05002670 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setModality@QWindow@@QAEXW4WindowModality@Qt@@@Z.QT5GUI(?), ref: 050026BF
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Modality@$?setQt@@@WindowWindow@@
                                                                                                                                                                                                                        • String ID: QWindow$setModality$setModality(self, modality: Qt.WindowModality)
                                                                                                                                                                                                                        • API String ID: 1474367730-2119791759
                                                                                                                                                                                                                        • Opcode ID: 718ce17e8d3f322eddb26215b7f80a25a22fad1dee7b434c659b46096b97fa80
                                                                                                                                                                                                                        • Instruction ID: 0ca5074fa62f8b69ffacf55722a32a7eca4e0e8c0554f97df61773f028fa40ef
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 718ce17e8d3f322eddb26215b7f80a25a22fad1dee7b434c659b46096b97fa80
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 310161342142059FE701DB54EC46E6977E5FB88710F144528F958C7390D775AD56DB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050186A0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setVisibility@QWindow@@QAEXW4Visibility@1@@Z.QT5GUI(?), ref: 050186EF
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?setVisibility@Visibility@1@@Window@@
                                                                                                                                                                                                                        • String ID: QWindow$setVisibility$setVisibility(self, v: QWindow.Visibility)
                                                                                                                                                                                                                        • API String ID: 4016697411-3805503242
                                                                                                                                                                                                                        • Opcode ID: 398d3efe4043bcbbc86e4aa303449051cfc5d0abb4b90c95436210a4206dc39d
                                                                                                                                                                                                                        • Instruction ID: 66849078c1d750f247eb7e0c7d796ea92f1af4a76df07f69960eb6fa6637eec5
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 398d3efe4043bcbbc86e4aa303449051cfc5d0abb4b90c95436210a4206dc39d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3B016D30214201AFD701DB64ED86E697BE5FB88710F544428FD5CD7390DB79AE5ADB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05038500 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?toVector3D@QVector2D@@QBE?AVQVector3D@@XZ.QT5GUI(00000000), ref: 0503854B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Vector3$Vector2malloc
                                                                                                                                                                                                                        • String ID: QVector2D$toVector3D$toVector3D(self) -> QVector3D
                                                                                                                                                                                                                        • API String ID: 2308512707-1170351835
                                                                                                                                                                                                                        • Opcode ID: 4459f6eff50367f702573fbff09a9e6a0359aac21571d035d099163747ebbc7c
                                                                                                                                                                                                                        • Instruction ID: ad6aa4f708f356e5d6f7143969c9c63d6ab6438a72d2056e86721bb373c2143c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4459f6eff50367f702573fbff09a9e6a0359aac21571d035d099163747ebbc7c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8D018431254201AFDB01EFA4EC46F6A77E4BB44701F440464F948D7250D675AD99DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05054500 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setAutoTristate@QStandardItem@@QAEX_N@Z.QT5GUI(?), ref: 05054549
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?setAutoItem@@StandardTristate@
                                                                                                                                                                                                                        • String ID: QStandardItem$setAutoTristate$setAutoTristate(self, tristate: bool)
                                                                                                                                                                                                                        • API String ID: 1473524681-3142682503
                                                                                                                                                                                                                        • Opcode ID: 029012e0d67073b5c7a0d9d95333fca63e5aeb496b1d4abbe3184791b03151b4
                                                                                                                                                                                                                        • Instruction ID: 912eaf7b4229399d7c63eb91f07dc521b3e588c735cfddfce87f46dbf2697fce
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 029012e0d67073b5c7a0d9d95333fca63e5aeb496b1d4abbe3184791b03151b4
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 05019230204201AFD701CF54EC42E6E7BE5FB88310F544424FD58C73A0DB79995ADB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0500C520 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setVerticalMovementX@QTextCursor@@QAEXH@Z.QT5GUI(?), ref: 0500C569
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?setCursor@@MovementTextVertical
                                                                                                                                                                                                                        • String ID: QTextCursor$setVerticalMovementX$setVerticalMovementX(self, x: int)
                                                                                                                                                                                                                        • API String ID: 2084158599-1590260451
                                                                                                                                                                                                                        • Opcode ID: 38d7915c3ed198605c1a5373236eee27f755050676fd2199e9ecdae346cf4be1
                                                                                                                                                                                                                        • Instruction ID: a3da8a43eb4cd2bd9608181396faf615dbfa6d24b43292eeb9ebf1b5f299f655
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 38d7915c3ed198605c1a5373236eee27f755050676fd2199e9ecdae346cf4be1
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: AC01D234204201AFD300CF64EC46E6DBBE4FB48310F544528F858D33A0DB759D4ACB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05000530 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?rect@QTextInlineObject@@QBE?AVQRectF@@XZ.QT5GUI(00000000), ref: 0500057B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?rect@InlineObject@@RectTextmalloc
                                                                                                                                                                                                                        • String ID: QTextInlineObject$rect$rect(self) -> QRectF
                                                                                                                                                                                                                        • API String ID: 953544639-1617625793
                                                                                                                                                                                                                        • Opcode ID: 0ffbfa512dd542e149708558ada297d1d856f0af6fa154cf61bd2d3e595ec90c
                                                                                                                                                                                                                        • Instruction ID: fea4cb182d56f0340c8701f16c705a9e1026c9572e884f1d584c6f204160367b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0ffbfa512dd542e149708558ada297d1d856f0af6fa154cf61bd2d3e595ec90c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0E01D430254201AFEA01DBA4FD02F997BE9FB48701F440464F908D7290D675ED99CB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0507A550 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?pixelFormat@QImage@@QBE?AVQPixelFormat@@XZ.QT5GUI(00000000), ref: 0507A59B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?pixelFormat@Format@@Image@@Pixelmalloc
                                                                                                                                                                                                                        • String ID: QImage$pixelFormat$pixelFormat(self) -> QPixelFormat
                                                                                                                                                                                                                        • API String ID: 3450603144-2313165337
                                                                                                                                                                                                                        • Opcode ID: 726382b727595f6e2084c44cd6fbfee8be8a8d8a87e6aab71764b70599f3909e
                                                                                                                                                                                                                        • Instruction ID: 48363a7f90ab1327bc892e05c969e7333be66d9b75fcad5a8a259064a494a007
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 726382b727595f6e2084c44cd6fbfee8be8a8d8a87e6aab71764b70599f3909e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5301F770254201AFDA00EFA4ED02F9A7BE8BB44701F444824F948D3250DB79ED99DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05090550 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?finalStop@QLinearGradient@@QBE?AVQPointF@@XZ.QT5GUI(00000000), ref: 0509059B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?finalGradient@@LinearPointStop@malloc
                                                                                                                                                                                                                        • String ID: QLinearGradient$finalStop$finalStop(self) -> QPointF
                                                                                                                                                                                                                        • API String ID: 3540026073-135976611
                                                                                                                                                                                                                        • Opcode ID: c12b32430ff2e6c0f8309d860d28145b1d9838294875ad0e147ad28ebea0f1da
                                                                                                                                                                                                                        • Instruction ID: 285def0a2294ba8dc672df2af44cf4099fbacbce421c87e7f0a1b672c96307da
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c12b32430ff2e6c0f8309d860d28145b1d9838294875ad0e147ad28ebea0f1da
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0E01A730254202AFDB01DBA4EC42F5977E8BB44701F444474FD48D7250E7B9EE99DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05088560 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?format@QMovie@@QBE?AVQByteArray@@XZ.QT5GUI(00000000), ref: 050885AB
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?format@Array@@ByteMovie@@malloc
                                                                                                                                                                                                                        • String ID: QMovie$format$format(self) -> QByteArray
                                                                                                                                                                                                                        • API String ID: 3265155878-1447355716
                                                                                                                                                                                                                        • Opcode ID: 97a660e546b53878fd91d86cce976dffc0bbf04d6bcf801bff70ed2e7201b4a8
                                                                                                                                                                                                                        • Instruction ID: 5712c4c34982d57dbe25a3b470c5a7f41a7fbc11b07a92dcbfee8305dad54d5d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 97a660e546b53878fd91d86cce976dffc0bbf04d6bcf801bff70ed2e7201b4a8
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1901F230254202AFEB00EBA4ED42F9977E9BB84700F440420FA48D7250D779EE99DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0504E570 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?begin@QTextFrame@@QBE?AViterator@1@XZ.QT5GUI(00000000), ref: 0504E5BB
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?begin@Frame@@TextViterator@1@malloc
                                                                                                                                                                                                                        • String ID: QTextFrame$begin$begin(self) -> QTextFrame.iterator
                                                                                                                                                                                                                        • API String ID: 1433143157-223376307
                                                                                                                                                                                                                        • Opcode ID: 93a40e5306f1636d368ac9e12081f096c0a0b7d0c1193c2f5fb3df72058758ec
                                                                                                                                                                                                                        • Instruction ID: ca512c42f7f817f1f990f457563504a6df043b13461262a4fbc53a143832d273
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 93a40e5306f1636d368ac9e12081f096c0a0b7d0c1193c2f5fb3df72058758ec
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A801F730254201AFDB00EBA4ED42F9977E8BB44700F440430FA08DB250D679ED99DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05084570 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?log@QOpenGLShaderProgram@@QBE?AVQString@@XZ.QT5GUI(00000000), ref: 050845BB
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?log@OpenProgram@@ShaderString@@malloc
                                                                                                                                                                                                                        • String ID: QOpenGLShaderProgram$log$log(self) -> str
                                                                                                                                                                                                                        • API String ID: 1319035928-2342341152
                                                                                                                                                                                                                        • Opcode ID: 24b7a984a006b752803dbcc43f3a9d3d09522b0e692dc053c418cceb6d02127f
                                                                                                                                                                                                                        • Instruction ID: c4d2d7709b0db952c61ac1076430fc12d5971b78ec92bfbbd3ab82233f343027
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 24b7a984a006b752803dbcc43f3a9d3d09522b0e692dc053c418cceb6d02127f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E801F730654202AFDA00EFA4EC42F5A77E4BB48701F444434FA48D3251E7B9EEA9DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05076580 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setDotsPerMeterX@QImage@@QAEXH@Z.QT5GUI(?), ref: 050765C9
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?setDotsImage@@Meter
                                                                                                                                                                                                                        • String ID: QImage$setDotsPerMeterX$setDotsPerMeterX(self, a0: int)
                                                                                                                                                                                                                        • API String ID: 3832985345-6156473
                                                                                                                                                                                                                        • Opcode ID: 41c208495a79b533f42313897887339a84dc35752bbf6080343175e79b879e3b
                                                                                                                                                                                                                        • Instruction ID: 9b306a5fb115b2a4b595e63d3a207cac0f8b7c9dff4994023513274c8ee025f1
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 41c208495a79b533f42313897887339a84dc35752bbf6080343175e79b879e3b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B1019E34204201AFD701DF94EC42EAA7BE4BB88710F548829FC59C73A0DB79DE4ADB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05036590 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?passwordMaskCharacter@QStyleHints@@QBE?AVQChar@@XZ.QT5GUI(00000000), ref: 050365DB
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?passwordChar@@Character@Hints@@MaskStylemalloc
                                                                                                                                                                                                                        • String ID: QStyleHints$passwordMaskCharacter$passwordMaskCharacter(self) -> str
                                                                                                                                                                                                                        • API String ID: 1794055144-1276905378
                                                                                                                                                                                                                        • Opcode ID: dd783462c7f62cbe0e3a76aa427d13575d6c69ee9a2151ef910c1f64db9896d6
                                                                                                                                                                                                                        • Instruction ID: e9bd53e7eb979d4c48825e17f10766b7a434b0fce421361ea0d9569279f29046
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: dd783462c7f62cbe0e3a76aa427d13575d6c69ee9a2151ef910c1f64db9896d6
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C301D430654201AFDA01EBA4ED43F5977E8BB44700F440424FA48D7250D679BE99CB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050385A0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43windowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setShowShortcutsInContextMenus@QStyleHints@@QAEX_N@Z.QT5GUI(?), ref: 050385E9
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • setShowShortcutsInContextMenus, xrefs: 05038617
                                                                                                                                                                                                                        • QStyleHints, xrefs: 0503861C
                                                                                                                                                                                                                        • setShowShortcutsInContextMenus(self, showShortcutsInContextMenus: bool), xrefs: 05038612
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?setContextHints@@Menus@ShortcutsShowStyle
                                                                                                                                                                                                                        • String ID: QStyleHints$setShowShortcutsInContextMenus$setShowShortcutsInContextMenus(self, showShortcutsInContextMenus: bool)
                                                                                                                                                                                                                        • API String ID: 535197672-4178169311
                                                                                                                                                                                                                        • Opcode ID: f5a9b68816a641828b4b1b053dae94078955cfc271c1886f90307ad6a9353871
                                                                                                                                                                                                                        • Instruction ID: 4aafae922de45b6a3b7a0763ffad23f0f0e1d3a85457d197d3600f1bde4cc56b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f5a9b68816a641828b4b1b053dae94078955cfc271c1886f90307ad6a9353871
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E9019E34208201AFD701DF94EC42E697BE8BB88710F548869FC58C73A0DB79A95ADB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0508A5A0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?frameRect@QMovie@@QBE?AVQRect@@XZ.QT5GUI(00000000), ref: 0508A5EB
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?frameMovie@@Rect@Rect@@malloc
                                                                                                                                                                                                                        • String ID: QMovie$frameRect$frameRect(self) -> QRect
                                                                                                                                                                                                                        • API String ID: 2614327994-2944330133
                                                                                                                                                                                                                        • Opcode ID: d291212854901733a8ae373cb618b914d49844323453899ee4c2e795912bc5e2
                                                                                                                                                                                                                        • Instruction ID: e2bb086d662b17044bf540e61c7748a7594639fe16e65317fdad8187b5de0dc3
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d291212854901733a8ae373cb618b914d49844323453899ee4c2e795912bc5e2
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6401F730654202AFDB01EFA4ED02F9A7BE9FB88700F440464FA48D7251D675ED99DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0500C5C0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?availableGeometry@QScreen@@QBE?AVQRect@@XZ.QT5GUI(00000000), ref: 0500C60B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?availableGeometry@Rect@@Screen@@malloc
                                                                                                                                                                                                                        • String ID: QScreen$availableGeometry$availableGeometry(self) -> QRect
                                                                                                                                                                                                                        • API String ID: 1745336275-3514874228
                                                                                                                                                                                                                        • Opcode ID: 40afee08bce617457f03fcf8e7b43a1bee9221f0882aad0a122012fe2feb2303
                                                                                                                                                                                                                        • Instruction ID: 3c3482d87102d8e068f56df733200ee6a5555bfc3b3ef18463f7a8c72506a4c5
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 40afee08bce617457f03fcf8e7b43a1bee9221f0882aad0a122012fe2feb2303
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3E01D430254201AFEA00EBA4ED02F5ABBE9FB88710F440464F948D7290D679ED999B52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0502A5D0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?tabs@QTextOption@@QBE?AV?$QList@UTab@QTextOption@@@@XZ.QT5GUI(00000000), ref: 0502A61B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Text$?tabs@List@Option@@Option@@@@Tab@malloc
                                                                                                                                                                                                                        • String ID: QTextOption$tabs$tabs(self) -> List[QTextOption.Tab]
                                                                                                                                                                                                                        • API String ID: 2592573823-3028197121
                                                                                                                                                                                                                        • Opcode ID: 4234e6ef32604e4cc01503f4d657315f3ed9fec54e18f829bbdc41a12a1a7892
                                                                                                                                                                                                                        • Instruction ID: 4b48764c9f16aef1b6731b23d70beb726a4fe29bcd5f613d71439a8ef573c3bd
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4234e6ef32604e4cc01503f4d657315f3ed9fec54e18f829bbdc41a12a1a7892
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F8018470254202AFEB01EBA4ED42E5A77E4FB44701F440464FA48D7250D675AE99DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0503A5F0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?charFormat@QTextBlock@@QBE?AVQTextCharFormat@@XZ.QT5GUI(00000000), ref: 0503A63B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Text$?charBlock@@CharFormat@Format@@malloc
                                                                                                                                                                                                                        • String ID: QTextBlock$charFormat$charFormat(self) -> QTextCharFormat
                                                                                                                                                                                                                        • API String ID: 1701405012-530317666
                                                                                                                                                                                                                        • Opcode ID: 27073b4e0a20eb74c10a0a8882342dd9834d914d2ce406f0ed9df0216a0a360c
                                                                                                                                                                                                                        • Instruction ID: 59e6e02be3581265fd2f82863c15619c5f95834ab045af8d14773c36aa0d7ead
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 27073b4e0a20eb74c10a0a8882342dd9834d914d2ce406f0ed9df0216a0a360c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F301F730654201AFDB01EFA4ED42F6A7BE8BB88700F440424FA48D7250D679ED99DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0507A5F0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?uniqueId@TouchPoint@QTouchEvent@@QBE?AVQPointingDeviceUniqueId@@XZ.QT5GUI(00000000), ref: 0507A63B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Touch$?uniqueDeviceEvent@@Id@@Point@PointingUniquemalloc
                                                                                                                                                                                                                        • String ID: TouchPoint$uniqueId$uniqueId(self) -> QPointingDeviceUniqueId
                                                                                                                                                                                                                        • API String ID: 412795845-1213194174
                                                                                                                                                                                                                        • Opcode ID: e8192e8ef5ea38d82488645ddc3c88dd75beb831c9532585430c012ec61e7b74
                                                                                                                                                                                                                        • Instruction ID: 4b277ed062ff18e0d1dcb8ea01d35ed1300ab7245dad3410a48b91edc3ea6fb1
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e8192e8ef5ea38d82488645ddc3c88dd75beb831c9532585430c012ec61e7b74
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9E01F730654201AFDB00EFA4EC02F5A77E8FB44700F444824F948D3260D779ED99DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05044460 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?toBlockFormat@QTextFormat@@QBE?AVQTextBlockFormat@@XZ.QT5GUI(00000000), ref: 050444AB
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: BlockFormat@@Text$Format@malloc
                                                                                                                                                                                                                        • String ID: QTextFormat$toTableFormat$toTableFormat(self) -> QTextTableFormat
                                                                                                                                                                                                                        • API String ID: 2120409781-1785544545
                                                                                                                                                                                                                        • Opcode ID: 0a49e0e148ad325f1913be4817a0e31cb4d21ba3c68e11eda6eeca876fa40722
                                                                                                                                                                                                                        • Instruction ID: 4af685678dc76b80e8d0c4ea055c3c38c2cd4f6739eeb4edde431de083ee96f8
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0a49e0e148ad325f1913be4817a0e31cb4d21ba3c68e11eda6eeca876fa40722
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4901D470254201AFEA00EBA4ED42F5977E8BB88701F040424F948D7250DA79ED9DDB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05018470 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?firstCursorPosition@QTextTableCell@@QBE?AVQTextCursor@@XZ.QT5GUI(00000000), ref: 050184BB
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • firstCursorPosition, xrefs: 050184E5
                                                                                                                                                                                                                        • QTextTableCell, xrefs: 050184EA
                                                                                                                                                                                                                        • firstCursorPosition(self) -> QTextCursor, xrefs: 050184E0
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Text$?firstCell@@CursorCursor@@Position@Tablemalloc
                                                                                                                                                                                                                        • String ID: QTextTableCell$firstCursorPosition$firstCursorPosition(self) -> QTextCursor
                                                                                                                                                                                                                        • API String ID: 535507860-506479228
                                                                                                                                                                                                                        • Opcode ID: f2b43011740503ad18e23f456e0e12899320891755b7b5913adbc6d7332c270b
                                                                                                                                                                                                                        • Instruction ID: 8670ab3323ebe0522f93155a2482302ab22dbbf0553c2cd920b3e598eb651692
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f2b43011740503ad18e23f456e0e12899320891755b7b5913adbc6d7332c270b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2A018F70254201AFEB01EBA4EC42F6A77E8BB44701F444824FA48D7250E679FE99DB66
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05028490 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setStereo@QSurfaceFormat@@QAEX_N@Z.QT5GUI(?), ref: 050284D9
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?setFormat@@Stereo@Surface
                                                                                                                                                                                                                        • String ID: QSurfaceFormat$setStereo$setStereo(self, enable: bool)
                                                                                                                                                                                                                        • API String ID: 643373722-942336058
                                                                                                                                                                                                                        • Opcode ID: a65df8d1b2fa943a099ba5af164c6bce46843fc175b7415562f7cdb1a3d53c1c
                                                                                                                                                                                                                        • Instruction ID: 290d880ce0b419ba44dbe5a3bf7b9f4e13b60132a5a166d0dfffb9622a0537d8
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a65df8d1b2fa943a099ba5af164c6bce46843fc175b7415562f7cdb1a3d53c1c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7701B534204201AFD701CF54EC42E6D77E4FB88714F544428FD58C73A0DB79A94ADB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050784A0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?lastScreenPos@TouchPoint@QTouchEvent@@QBE?AVQPointF@@XZ.QT5GUI(00000000), ref: 050784EB
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Touch$?lastEvent@@PointPoint@Pos@Screenmalloc
                                                                                                                                                                                                                        • String ID: TouchPoint$lastScreenPos$lastScreenPos(self) -> QPointF
                                                                                                                                                                                                                        • API String ID: 912611967-1323369349
                                                                                                                                                                                                                        • Opcode ID: 17ae52166e616ae0b78a808fdf2203d70bc8ea77bf3372ea6a1e9567a0422b4e
                                                                                                                                                                                                                        • Instruction ID: 2dd94f457d7a72881a487f10ae21f56aa4934b310256a04680c296451f47a116
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 17ae52166e616ae0b78a808fdf2203d70bc8ea77bf3372ea6a1e9567a0422b4e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1401F770654201AFDB01EFA4EC42F6A7BE8BB44700F444434FA48D7250D7B9EE99DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050904B0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setPatchVertexCount@QOpenGLShaderProgram@@QAEXH@Z.QT5GUI(?), ref: 050904F9
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • setPatchVertexCount, xrefs: 05090527
                                                                                                                                                                                                                        • setPatchVertexCount(self, count: int), xrefs: 05090522
                                                                                                                                                                                                                        • QOpenGLShaderProgram, xrefs: 0509052C
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?setCount@OpenPatchProgram@@ShaderVertex
                                                                                                                                                                                                                        • String ID: QOpenGLShaderProgram$setPatchVertexCount$setPatchVertexCount(self, count: int)
                                                                                                                                                                                                                        • API String ID: 2633223634-2666354399
                                                                                                                                                                                                                        • Opcode ID: 863396ea39f4d190764f9edf7ded03da5dd1a82af28befd6ec7bb2efc4d89078
                                                                                                                                                                                                                        • Instruction ID: 050fa5a1dae4f59fb65d4897b6a62670abb8ad2312a1aaa99c21b4809e57aedb
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 863396ea39f4d190764f9edf7ded03da5dd1a82af28befd6ec7bb2efc4d89078
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C1018034208201AFD741DB64EC46E6A7BE4BB48710F544464F858C33A0DB799D5ADB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050264C0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setResolution@QPdfWriter@@QAEXH@Z.QT5GUI(?), ref: 05026509
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?setResolution@Writer@@
                                                                                                                                                                                                                        • String ID: QPdfWriter$setResolution$setResolution(self, resolution: int)
                                                                                                                                                                                                                        • API String ID: 3182610714-59700000
                                                                                                                                                                                                                        • Opcode ID: de84044e89387af1aaa0dba87400d1081d3df246d1f303775e1d5e80712a3b3b
                                                                                                                                                                                                                        • Instruction ID: 3b5bd703d232f917456073e7361690ae17c11ed8558471a4baf3607c91448797
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: de84044e89387af1aaa0dba87400d1081d3df246d1f303775e1d5e80712a3b3b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A3019E30204201AFD701DF54EC42E697BE4FB88710F544428FC58C73A0DB79AD4ADB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050124E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setWidth@QWindow@@QAEXH@Z.QT5GUI(?), ref: 05012529
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?setWidth@Window@@
                                                                                                                                                                                                                        • String ID: QWindow$setWidth$setWidth(self, arg: int)
                                                                                                                                                                                                                        • API String ID: 65384081-370110553
                                                                                                                                                                                                                        • Opcode ID: 536b603f682cb3124be5a17d6cbac4edffd53525e7cf4db63c31f5e664fac965
                                                                                                                                                                                                                        • Instruction ID: 5c38dfeb7b0870626e13a06bd104cbfabb1a01ee5367c87d491fde232ce402ba
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 536b603f682cb3124be5a17d6cbac4edffd53525e7cf4db63c31f5e664fac965
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A6019234204202AFD701DF54EC82E697BE5BB88710F544428FC58C73A0DB79AD4ADB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050304F0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?charFormat@QTextFragment@@QBE?AVQTextCharFormat@@XZ.QT5GUI(00000000), ref: 0503053B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Text$?charCharFormat@Format@@Fragment@@malloc
                                                                                                                                                                                                                        • String ID: QTextFragment$charFormat$charFormat(self) -> QTextCharFormat
                                                                                                                                                                                                                        • API String ID: 869584995-2633865606
                                                                                                                                                                                                                        • Opcode ID: 77e5487a01586cdc933fd12e2764418269bd45b49f7905a22d07ee860e70e4b7
                                                                                                                                                                                                                        • Instruction ID: 00339af1c50db4821593da35ab5747ad8fab4ba58c1c5e71639fd9baaf5ec11a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 77e5487a01586cdc933fd12e2764418269bd45b49f7905a22d07ee860e70e4b7
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9401A730654201AFDB01EBA4EC46F6A77E8FB44701F440424FA48D7650D679EE99DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0508C700 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?scaledSize@QMovie@@QAE?AVQSize@@XZ.QT5GUI(00000000), ref: 0508C74B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?scaledMovie@@Size@Size@@malloc
                                                                                                                                                                                                                        • String ID: QMovie$scaledSize$scaledSize(self) -> QSize
                                                                                                                                                                                                                        • API String ID: 2634274862-3171178454
                                                                                                                                                                                                                        • Opcode ID: b83674bd3c6df8e6e2ec8be9397e3b8c00fe48d8eb8204763fc3027b6036a502
                                                                                                                                                                                                                        • Instruction ID: 5e3d54286593158fdf0a9bf55cb08c34e244b03727b01e6166372bc514faaa78
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b83674bd3c6df8e6e2ec8be9397e3b8c00fe48d8eb8204763fc3027b6036a502
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 94014770250201AFEB00EBA4EE42F593BE4BB84701F040460FA48D7260D775ED99DB22
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05026710 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setSamples@QSurfaceFormat@@QAEXH@Z.QT5GUI(?), ref: 05026759
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?setFormat@@Samples@Surface
                                                                                                                                                                                                                        • String ID: QSurfaceFormat$setSamples$setSamples(self, numSamples: int)
                                                                                                                                                                                                                        • API String ID: 3471402103-3816964038
                                                                                                                                                                                                                        • Opcode ID: e8b9a4f7ebe26c9e35a6b4b6ce0b9dde204af1f9a574c8b28db9e9b94a0cc32b
                                                                                                                                                                                                                        • Instruction ID: 7f39b4bb68dbeebc8e8f302014d573e2dbc4f05dddf098bab7ea48baf3f1f3b1
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e8b9a4f7ebe26c9e35a6b4b6ce0b9dde204af1f9a574c8b28db9e9b94a0cc32b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8701B134208201AFD701DFA4EC82E697BF4FB88710F544428F858C73A0DB799D4ADB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0500A730 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setMaximumTouchPoints@QTouchDevice@@QAEXH@Z.QT5GUI(?), ref: 0500A779
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • setMaximumTouchPoints(self, max: int), xrefs: 0500A7A2
                                                                                                                                                                                                                        • QTouchDevice, xrefs: 0500A7AC
                                                                                                                                                                                                                        • setMaximumTouchPoints, xrefs: 0500A7A7
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Touch$?setDevice@@MaximumPoints@
                                                                                                                                                                                                                        • String ID: QTouchDevice$setMaximumTouchPoints$setMaximumTouchPoints(self, max: int)
                                                                                                                                                                                                                        • API String ID: 3229369142-918839554
                                                                                                                                                                                                                        • Opcode ID: 2bab72b30ff634d933e63fa4668a9bbeac6bf2248fb11e504869b6d4013e0cd0
                                                                                                                                                                                                                        • Instruction ID: 491492885d98736521d866907b8fb44ee6000ae1812346afe3304f5e5d905fb0
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2bab72b30ff634d933e63fa4668a9bbeac6bf2248fb11e504869b6d4013e0cd0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7F019270204201AFD701DF54ED42E6A7BE5FB88710F548465FC5CD33A0DB75A94ADB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05018740 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?lastCursorPosition@QTextTableCell@@QBE?AVQTextCursor@@XZ.QT5GUI(00000000), ref: 0501878B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • lastCursorPosition(self) -> QTextCursor, xrefs: 050187B0
                                                                                                                                                                                                                        • lastCursorPosition, xrefs: 050187B5
                                                                                                                                                                                                                        • QTextTableCell, xrefs: 050187BA
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Text$?lastCell@@CursorCursor@@Position@Tablemalloc
                                                                                                                                                                                                                        • String ID: QTextTableCell$lastCursorPosition$lastCursorPosition(self) -> QTextCursor
                                                                                                                                                                                                                        • API String ID: 1492964463-108271912
                                                                                                                                                                                                                        • Opcode ID: 7265230133104d5ffb5cf569e439e8b8ac7b193e98ed6053df4e4e4cdeb9c894
                                                                                                                                                                                                                        • Instruction ID: 76f65df5ea33abb083680ebba72f9e4a0c0abebc085d52e88abae82ef6ac986e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7265230133104d5ffb5cf569e439e8b8ac7b193e98ed6053df4e4e4cdeb9c894
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2401A770654202AFDB01EBA4ED42F6A7BE8BB44701F440424F948D7250D679FE99DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FFC690 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?position@QTextLayout@@QBE?AVQPointF@@XZ.QT5GUI(00000000), ref: 04FFC6DB
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?position@Layout@@PointTextmalloc
                                                                                                                                                                                                                        • String ID: QTextLayout$position$position(self) -> QPointF
                                                                                                                                                                                                                        • API String ID: 968516101-3527604223
                                                                                                                                                                                                                        • Opcode ID: c46ec620017af82f69779e3c7eff1c0d2315042b3185174364d30684b58fcd30
                                                                                                                                                                                                                        • Instruction ID: 5ea1c62a1806cb87211dd03808da2762c405849669a112637b554ea52e3e090e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c46ec620017af82f69779e3c7eff1c0d2315042b3185174364d30684b58fcd30
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: EA01F730654201AFDB00DBE4FD42F6977E8FB48701F440424F948D7250DA75ED99DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FF2680 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?locale@QValidator@@QBE?AVQLocale@@XZ.QT5GUI(00000000), ref: 04FF26CB
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?locale@Locale@@Validator@@malloc
                                                                                                                                                                                                                        • String ID: QValidator$locale$locale(self) -> QLocale
                                                                                                                                                                                                                        • API String ID: 1800458842-1864001899
                                                                                                                                                                                                                        • Opcode ID: c24002298dd913f84ca825179c6021f0926405fa22a2d6570ea3c6f8126d9de1
                                                                                                                                                                                                                        • Instruction ID: 23bd2b23c9f86a58267ac43c12b1236006718a88dc4b59b7c4bdf06899d5d42e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c24002298dd913f84ca825179c6021f0926405fa22a2d6570ea3c6f8126d9de1
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B601DF30654202AFDA00EBA4FC42FAA77E8FB48700F440464FA08D7250D679BD99CB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0503E790 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setLineCount@QTextBlock@@QAEXH@Z.QT5GUI(?), ref: 0503E7D9
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?setBlock@@Count@LineText
                                                                                                                                                                                                                        • String ID: QTextBlock$setLineCount$setLineCount(self, count: int)
                                                                                                                                                                                                                        • API String ID: 3994785123-129705569
                                                                                                                                                                                                                        • Opcode ID: 39577647b94f9ecbb8e7808c0c79d8832e5544640e99793b4986789a2e1d2947
                                                                                                                                                                                                                        • Instruction ID: 5f845c093f4f344df78a96de8051f77b66f20125356ec4e80bbb2740423f633d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 39577647b94f9ecbb8e7808c0c79d8832e5544640e99793b4986789a2e1d2947
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4C01B130254201AFD701DFA4EC82E697BE8FB88710F544568FD58C73A0DB799D4ADB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050127A0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setHeight@QWindow@@QAEXH@Z.QT5GUI(?), ref: 050127E9
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?setHeight@Window@@
                                                                                                                                                                                                                        • String ID: QWindow$setHeight$setHeight(self, arg: int)
                                                                                                                                                                                                                        • API String ID: 3153827525-3907896206
                                                                                                                                                                                                                        • Opcode ID: 42ba33f8c4d425ef1a63b907b3c396f93b1a1bd7aa28b4d39539a0a210868e58
                                                                                                                                                                                                                        • Instruction ID: ab6a0f2d39b1ba64b0943402d6ab7203c13c41ae617c29f27dd6b965c5d598b9
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 42ba33f8c4d425ef1a63b907b3c396f93b1a1bd7aa28b4d39539a0a210868e58
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 62019E34244202AFD701DF54EC42E6A7BE8FB88710F548428FD58C73A0DB79A95ADB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FF8650 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?size@QTextDocument@@QBE?AVQSizeF@@XZ.QT5GUI(00000000), ref: 04FF869B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?size@Document@@SizeTextmalloc
                                                                                                                                                                                                                        • String ID: QTextDocument$size$size(self) -> QSizeF
                                                                                                                                                                                                                        • API String ID: 1638836423-3329188371
                                                                                                                                                                                                                        • Opcode ID: 0b56b6906d726bc08d5b251000b345b47cab719ca6db1326f8872874fb91bccf
                                                                                                                                                                                                                        • Instruction ID: bf3a04150a3619907d99316f31d0f6d22da5344a028c1068971995deb54936b4
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0b56b6906d726bc08d5b251000b345b47cab719ca6db1326f8872874fb91bccf
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1E01F770254201AFDB01EFA4EC02F997BE8FB48701F040420F948D7260D775ED99DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050047D0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?block@QTextCursor@@QBE?AVQTextBlock@@XZ.QT5GUI(00000000), ref: 0500481B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Text$?block@Block@@Cursor@@malloc
                                                                                                                                                                                                                        • String ID: QTextCursor$block$block(self) -> QTextBlock
                                                                                                                                                                                                                        • API String ID: 1412114197-206823455
                                                                                                                                                                                                                        • Opcode ID: ca75ccfda22e840dacfb0759e4110f01f03acff14fc61bc37953a95be50e0111
                                                                                                                                                                                                                        • Instruction ID: e5bd36a3e047f75c029651530d06663ea8d79ae90ddb1c9cc37d34a405c0a0a3
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ca75ccfda22e840dacfb0759e4110f01f03acff14fc61bc37953a95be50e0111
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4D01D430654201AFEA01DBA4ED42F5977E8BB88701F444424FA48D7250EA75EE59DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0500A7D0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?framePosition@QWindow@@QBE?AVQPoint@@XZ.QT5GUI(00000000), ref: 0500A81B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?framePoint@@Position@Window@@malloc
                                                                                                                                                                                                                        • String ID: QWindow$framePosition$framePosition(self) -> QPoint
                                                                                                                                                                                                                        • API String ID: 12385231-2646168898
                                                                                                                                                                                                                        • Opcode ID: 7b252c614d0dbe31b0b3da05c20d5ffb81190626e8cd463e9b5cc12b0adcb636
                                                                                                                                                                                                                        • Instruction ID: b9d04dbc34d68c30b4810e27890bff861e1759091f6522117cb4d6c0e2576062
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7b252c614d0dbe31b0b3da05c20d5ffb81190626e8cd463e9b5cc12b0adcb636
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7D01F770254201AFDA00EFA4ED42F5977E8BB84701F440460F948D7250D675ED99CB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050507D0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?combinedTransform@QPainter@@QBE?AVQTransform@@XZ.QT5GUI(00000000), ref: 0505081B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?combinedPainter@@Transform@Transform@@malloc
                                                                                                                                                                                                                        • String ID: QPainter$combinedTransform$combinedTransform(self) -> QTransform
                                                                                                                                                                                                                        • API String ID: 1608184335-2183641183
                                                                                                                                                                                                                        • Opcode ID: 04ada6ad8ca6acf05b045579e1ba6f7b6e096d5539b0f1a1b5ed006b93a2b52c
                                                                                                                                                                                                                        • Instruction ID: ba4ab721d2e9826d43c3aa2961b0277cfd081c8b7b91b1eecc2b1f8910e3ebeb
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 04ada6ad8ca6acf05b045579e1ba6f7b6e096d5539b0f1a1b5ed006b93a2b52c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4401F770254201AFDB00DBA4EC42F9A77E4FB88701F440820FA48D7260D7B9FD99DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0504A600 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?renderHints@QPainter@@QBE?AV?$QFlags@W4RenderHint@QPainter@@@@XZ.QT5GUI(00000000), ref: 0504A64B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?renderFlags@Hint@Hints@Painter@@Painter@@@@Rendermalloc
                                                                                                                                                                                                                        • String ID: QPainter$renderHints$renderHints(self) -> QPainter.RenderHints
                                                                                                                                                                                                                        • API String ID: 4089948087-2952522471
                                                                                                                                                                                                                        • Opcode ID: 3326adf99a1b9f6f22b31eaaf8d4685352d75820d81823202fa15b1b6d5161c2
                                                                                                                                                                                                                        • Instruction ID: f0203bd39dacb166eb9b63820de137081ba9268bded7b88802487da6dc29d7ec
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3326adf99a1b9f6f22b31eaaf8d4685352d75820d81823202fa15b1b6d5161c2
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: DC01F770654201AFDB00EFA4ED42F5977E8BB44701F440824FA08D7290D7B9ED99DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FE27C0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?minimumMargins@QPageLayout@@QBE?AVQMarginsF@@XZ.QT5GUI(00000000), ref: 04FE280B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?minimumLayout@@MarginsMargins@Pagemalloc
                                                                                                                                                                                                                        • String ID: QPageLayout$minimumMargins$minimumMargins(self) -> QMarginsF
                                                                                                                                                                                                                        • API String ID: 3903517369-1509855121
                                                                                                                                                                                                                        • Opcode ID: 2a98190054830f0935908ef001d45b72328c8aa15440ed00f2299293d46332e9
                                                                                                                                                                                                                        • Instruction ID: 0c79eeffd02360828aa8f3ae8541ca78cfe1492e6e94b529bc94a186b0f8b4d9
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2a98190054830f0935908ef001d45b72328c8aa15440ed00f2299293d46332e9
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5501F770654201AFDB01EFA4ED02F597BE8FB88701F440460FD08D7250E675ED99CB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FF47B0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?adjoint@QTransform@@QBE?AV1@XZ.QT5GUI(00000000), ref: 04FF47FB
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?adjoint@Transform@@malloc
                                                                                                                                                                                                                        • String ID: QTransform$adjoint$adjoint(self) -> QTransform
                                                                                                                                                                                                                        • API String ID: 1382169850-3274404985
                                                                                                                                                                                                                        • Opcode ID: 975d6e851135d41d209761405893b1a6a4e03e600cd425f5c5498255d92e6c89
                                                                                                                                                                                                                        • Instruction ID: d26f06bc4af547935f2771c7833e9f00df6c4ab98384f3d06a012f219658d259
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 975d6e851135d41d209761405893b1a6a4e03e600cd425f5c5498255d92e6c89
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CF01F230654201AFEB01EBA4EC42FAE7BE4BB88711F440460F908D7260D679FD99DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05044650 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?background@QStandardItem@@QBE?AVQBrush@@XZ.QT5GUI(00000000), ref: 0504469B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?background@Brush@@Item@@Standardmalloc
                                                                                                                                                                                                                        • String ID: QStandardItem$background$background(self) -> QBrush
                                                                                                                                                                                                                        • API String ID: 1937218196-2948526034
                                                                                                                                                                                                                        • Opcode ID: 446bf812f4149cca74aea22bc8b2e05e07c93c0952d77676f645217ff031601f
                                                                                                                                                                                                                        • Instruction ID: 21ad04e799e2441a24c0c4f6bbbb5ef861656028d01ead6bdb58c0e3f215306a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 446bf812f4149cca74aea22bc8b2e05e07c93c0952d77676f645217ff031601f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BA01F270254201AFDB00EFA4ED42F9A77E8FB84701F440824FA08D7250E779EE99CB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0505C650 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?setDecimals@QDoubleValidator@@QAEXH@Z.QT5GUI(?), ref: 0505C699
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?setDecimals@DoubleValidator@@
                                                                                                                                                                                                                        • String ID: QDoubleValidator$setDecimals$setDecimals(self, a0: int)
                                                                                                                                                                                                                        • API String ID: 2819870426-3906973720
                                                                                                                                                                                                                        • Opcode ID: 92827fea5e6aaecb292d29623dc0b40cec7d6d990662d5fad8878910198da1a8
                                                                                                                                                                                                                        • Instruction ID: d709f77ff901599e8e3c6388c0479990c96e3299edda8f6acb556aaca3c4820f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 92827fea5e6aaecb292d29623dc0b40cec7d6d990662d5fad8878910198da1a8
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: DB01B130208201AFD701DF64EC42E6A7BE4FB88710F544869FC58C73A0DB79AE4ADB02
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0500C660 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?filePath@QWindow@@QBE?AVQString@@XZ.QT5GUI(00000000), ref: 0500C6AB
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?filePath@String@@Window@@malloc
                                                                                                                                                                                                                        • String ID: QWindow$filePath$filePath(self) -> str
                                                                                                                                                                                                                        • API String ID: 4173617996-890896491
                                                                                                                                                                                                                        • Opcode ID: c2ac151641cd52469e211df4df294783e8406244cc3500cec82a8143817fdfaf
                                                                                                                                                                                                                        • Instruction ID: 09aeb1509726b0c291cae4ebf9f1052d2616d58fc84828dd19203453d935cee0
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c2ac151641cd52469e211df4df294783e8406244cc3500cec82a8143817fdfaf
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2B01A770254201AFEB01EBA4ED42F6A77E8FB88701F440424FA48D7260D675FD99DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05054670 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?inverted@QQuaternion@@QBE?AV1@XZ.QT5GUI(00000000), ref: 050546BB
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?inverted@Quaternion@@malloc
                                                                                                                                                                                                                        • String ID: QQuaternion$inverted$inverted(self) -> QQuaternion
                                                                                                                                                                                                                        • API String ID: 2793976183-249662126
                                                                                                                                                                                                                        • Opcode ID: 1e71b531adaef973eff9620d6e06be9467b236ef87e43e84a0ea5220c21f7144
                                                                                                                                                                                                                        • Instruction ID: 02fd57f3f11bcc2c405d2454dd3328e7cd05a121df86f07624cb5ffc61c7d12a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1e71b531adaef973eff9620d6e06be9467b236ef87e43e84a0ea5220c21f7144
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2C01F730654201AFEB00EBA4ED02F9A77E8FB44701F440420F948D3291D679ED99DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0501E690 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?numberPrefix@QTextListFormat@@QBE?AVQString@@XZ.QT5GUI(00000000), ref: 0501E6DB
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?numberFormat@@ListPrefix@String@@Textmalloc
                                                                                                                                                                                                                        • String ID: QTextListFormat$numberPrefix$numberPrefix(self) -> str
                                                                                                                                                                                                                        • API String ID: 3887568297-2020782398
                                                                                                                                                                                                                        • Opcode ID: 6c2bc9ba2350236ac4a9729bb93edb5a5cbf2aa5bbe4cb25bee29b5c5c10dabc
                                                                                                                                                                                                                        • Instruction ID: ada0d73663efc41cc2ce46350c781149e3911f54904f9d237062894c23bf5b32
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6c2bc9ba2350236ac4a9729bb93edb5a5cbf2aa5bbe4cb25bee29b5c5c10dabc
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C301F770254202AFDB01EFA4ED42F5A7BE8FB44700F440424FE48D7250E679EE59DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0501C690 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?toVector2DAffine@QVector4D@@QBE?AVQVector2D@@XZ.QT5GUI(00000000), ref: 0501C6DB
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Vector2$Affine@Vector4malloc
                                                                                                                                                                                                                        • String ID: QVector4D$toVector2DAffine$toVector2DAffine(self) -> QVector2D
                                                                                                                                                                                                                        • API String ID: 3590145354-762013544
                                                                                                                                                                                                                        • Opcode ID: f2dd12868d7a758fbdb754fb94cba219d149cc31611529ae8359059e16819dd9
                                                                                                                                                                                                                        • Instruction ID: 2d64639c6ed76e672d9b4b58750c4e2f07c7eac962c1677303b8139f59df4395
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f2dd12868d7a758fbdb754fb94cba219d149cc31611529ae8359059e16819dd9
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F501F770654201AFEA01EFA4FD02F9A77E4FB84700F044464F948D7250D675FD99DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05050690 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?pen@QPaintEngineState@@QBE?AVQPen@@XZ.QT5GUI(00000000), ref: 050506DB
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?pen@EnginePaintPen@@State@@malloc
                                                                                                                                                                                                                        • String ID: QPaintEngineState$pen$pen(self) -> QPen
                                                                                                                                                                                                                        • API String ID: 2818443940-1888326320
                                                                                                                                                                                                                        • Opcode ID: 1bf3124dfe3587c6b579cd6f210a2b583ecfbdf2592573579e37cca58d93bd79
                                                                                                                                                                                                                        • Instruction ID: 23c7c0ed65f775515b9f071078e5f6a8a9af9ace5e5ebc81e03319a8bba7e852
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1bf3124dfe3587c6b579cd6f210a2b583ecfbdf2592573579e37cca58d93bd79
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1701D430254202AFDB00DBA4EC42F5A77E4FB48701F440424FA48D7250D7B9ED998B62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05080690 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?shaders@QOpenGLShaderProgram@@QBE?AV?$QList@PAVQOpenGLShader@@@@XZ.QT5GUI(00000000), ref: 050806DB
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Open$?shaders@List@Program@@ShaderShader@@@@malloc
                                                                                                                                                                                                                        • String ID: QOpenGLShaderProgram$shaders$shaders(self) -> List[QOpenGLShader]
                                                                                                                                                                                                                        • API String ID: 4278336699-3124767408
                                                                                                                                                                                                                        • Opcode ID: d0491ff382d8d47881f3b6960f86d6040a443b16b668ad45158636acb78c3658
                                                                                                                                                                                                                        • Instruction ID: f60ade6c46218b3617c70deb94a30e228d4e378b901d6d5461a8b9fde4aa6fb7
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d0491ff382d8d47881f3b6960f86d6040a443b16b668ad45158636acb78c3658
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9D01F730254202AFDA00EFA4ED42F5977E4BB84701F440420FA48D3290E6B5EE99DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FFC430 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?takeVerticalHeaderItem@QStandardItemModel@@QAEPAVQStandardItem@@H@Z.QT5GUI(?), ref: 04FFC479
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • QStandardItemModel, xrefs: 04FFC4AC
                                                                                                                                                                                                                        • takeVerticalHeaderItem, xrefs: 04FFC4A7
                                                                                                                                                                                                                        • takeVerticalHeaderItem(self, row: int) -> Optional[QStandardItem], xrefs: 04FFC4A2
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Standard$?takeHeaderItemItem@Item@@Model@@Vertical
                                                                                                                                                                                                                        • String ID: QStandardItemModel$takeVerticalHeaderItem$takeVerticalHeaderItem(self, row: int) -> Optional[QStandardItem]
                                                                                                                                                                                                                        • API String ID: 3666662607-150036698
                                                                                                                                                                                                                        • Opcode ID: 5a61c3f1ca956f1a040c934ab2810855ea1c409edf2b9e013f38d51e7eaf5996
                                                                                                                                                                                                                        • Instruction ID: d1a02a6a63f0b98680a6c4d078bb850cb9a71c58b50b4a613bc748e2913c3fc5
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5a61c3f1ca956f1a040c934ab2810855ea1c409edf2b9e013f38d51e7eaf5996
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 79017130154201BFD701DF94EC42EAA7BE9FB88700F444424F958C7261E77AEE99DB42
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FF85B0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?verticalHeaderItem@QStandardItemModel@@QBEPAVQStandardItem@@H@Z.QT5GUI(?), ref: 04FF85F9
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • QStandardItemModel, xrefs: 04FF8628
                                                                                                                                                                                                                        • verticalHeaderItem(self, row: int) -> Optional[QStandardItem], xrefs: 04FF861E
                                                                                                                                                                                                                        • verticalHeaderItem, xrefs: 04FF8623
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Standard$?verticalHeaderItemItem@Item@@Model@@
                                                                                                                                                                                                                        • String ID: QStandardItemModel$verticalHeaderItem$verticalHeaderItem(self, row: int) -> Optional[QStandardItem]
                                                                                                                                                                                                                        • API String ID: 24261160-1289150604
                                                                                                                                                                                                                        • Opcode ID: 12091a5357193cf54242ac324c51a9c9c3275c1e2a830353f6bed9df4dee405a
                                                                                                                                                                                                                        • Instruction ID: 35ffa419ffcb577847ae3743f6b7f4d9a6a8438c90808950ed76fb8d1d496d16
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 12091a5357193cf54242ac324c51a9c9c3275c1e2a830353f6bed9df4dee405a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 70018430254101AFD701DF94EC42E6A7BE9FB88700F444825FD58C7261D775EE99DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05096510 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?release@QOpenGLVertexArrayObject@@QAEXXZ.QT5GUI ref: 05096552
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?release@ArrayObject@@OpenVertex
                                                                                                                                                                                                                        • String ID: Binder$release$release(self)
                                                                                                                                                                                                                        • API String ID: 2084968487-3144160818
                                                                                                                                                                                                                        • Opcode ID: 5ce7396558d1f0b081b23c26bc4c386d143e998286a41c7bd900507d044c4a2c
                                                                                                                                                                                                                        • Instruction ID: c074cd13488beddcb0ccd32cc26e3372d2d028fe4c3b97c43a588ada2f7d6d0c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5ce7396558d1f0b081b23c26bc4c386d143e998286a41c7bd900507d044c4a2c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 57017C302442019FDB00EFA4ED82D6977F5FB88711F544468F849D73A0EB79AD4ADB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0506E560 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 40COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?scanLine@QImage@@QAEPAEH@Z.QT5GUI(?), ref: 0506E5A9
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?scanImage@@Line@
                                                                                                                                                                                                                        • String ID: QImage$scanLine$scanLine(self, a0: int) -> Optional[PyQt5.sip.voidptr]
                                                                                                                                                                                                                        • API String ID: 1651689473-1207214091
                                                                                                                                                                                                                        • Opcode ID: ebe642fa56587149b93b659b09cecd49491e1a82c43414ac8e910d85505b84e2
                                                                                                                                                                                                                        • Instruction ID: 9cff8559ed9999ddd18db758095f3e3128aa5790ce1667211d8ecbadb8814ee8
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ebe642fa56587149b93b659b09cecd49491e1a82c43414ac8e910d85505b84e2
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5E01A274104201AFD701DFA4EC42EAA7BE8BB88710F448425FD58C3260D778EE99DB42
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FEE460 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 40COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?endMoveColumns@QAbstractItemModel@@IAEXXZ.QT5CORE ref: 04FEE4A0
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?endAbstractColumns@ItemModel@@Move
                                                                                                                                                                                                                        • String ID: QStandardItemModel$endMoveColumns$endMoveColumns(self)
                                                                                                                                                                                                                        • API String ID: 2131576783-882805416
                                                                                                                                                                                                                        • Opcode ID: 9f7f82b8690c8fd8e3c43f88405b88b5f8732e78aae3b403e18f81cea5105ee3
                                                                                                                                                                                                                        • Instruction ID: c1c71db7276f1dfee24f62d03a7bb241bd682482f38ffe691f2c50cfe40ae068
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9f7f82b8690c8fd8e3c43f88405b88b5f8732e78aae3b403e18f81cea5105ee3
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 18018F34254201AFDB00DFA4ED42E697BF5FB88701F500868F848D7390DB79AD5ADB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050945F0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 40COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?optimize@QMatrix4x4@@QAEXXZ.QT5GUI ref: 05094630
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?optimize@Matrix4x4@@
                                                                                                                                                                                                                        • String ID: QMatrix4x4$optimize$optimize(self)
                                                                                                                                                                                                                        • API String ID: 4079651539-2438295959
                                                                                                                                                                                                                        • Opcode ID: 445af5e4eaf5aae1e07d548312a6d6bd678d3e8485f0ea321cd2050e6de6b35e
                                                                                                                                                                                                                        • Instruction ID: 295b8130c434b626ebf68a84266a8002b872650d1685a11680de5c859c97d0b6
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 445af5e4eaf5aae1e07d548312a6d6bd678d3e8485f0ea321cd2050e6de6b35e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0301FD30254201AFDB00DFA4ED82E697BE4FB88701F500868F848C73A0DB79AD4ADB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0505C4F0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 40COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?clear@?$QVector@VQPointF@@@@QAEXXZ.QT5CORE ref: 0505C530
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?clear@?$F@@@@PointVector@
                                                                                                                                                                                                                        • String ID: QPolygonF$clear$clear(self)
                                                                                                                                                                                                                        • API String ID: 3433129892-1283402514
                                                                                                                                                                                                                        • Opcode ID: 4f041b7d70a6fe373ba5e02174f68c8062a159a818618dcd172daa3355809ed8
                                                                                                                                                                                                                        • Instruction ID: 5d467e73fd6e2cc6d8fa50119450f897c040dcb8fb26a56875e36cbe279efd2a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4f041b7d70a6fe373ba5e02174f68c8062a159a818618dcd172daa3355809ed8
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0101DF30244201AFDB00EFA8ED82E6A7BE4FB48711F500428F848C7390DB78EC4ADB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05002710 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 40COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?deleteChar@QTextCursor@@QAEXXZ.QT5GUI ref: 05002750
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?deleteChar@Cursor@@Text
                                                                                                                                                                                                                        • String ID: QTextCursor$deleteChar$deleteChar(self)
                                                                                                                                                                                                                        • API String ID: 1758355957-3969889634
                                                                                                                                                                                                                        • Opcode ID: 674a3dc968f077c735a54bafb58b77e43a8b6f979fc6256856cd6e7ab6366999
                                                                                                                                                                                                                        • Instruction ID: cef875371f23bd84b1aa071f82a8048b90088c711d29976b0f6bdc478a794ee4
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 674a3dc968f077c735a54bafb58b77e43a8b6f979fc6256856cd6e7ab6366999
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9D01DF342042029FD700DFA4ED86E6977F5FB88700F500428F848D7390DB79AD1ACB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05010710 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 40COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?hide@QWindow@@QAEXXZ.QT5GUI ref: 05010750
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?hide@Window@@
                                                                                                                                                                                                                        • String ID: QWindow$hide$hide(self)
                                                                                                                                                                                                                        • API String ID: 1870406909-557731129
                                                                                                                                                                                                                        • Opcode ID: a2af9c49835c98fbd8a6975f9178027b57d695e3064de645e4bd042cf47d3c0c
                                                                                                                                                                                                                        • Instruction ID: bfc19b36dd32e28e5d05a59b85ffef3207fe0b693feaba1d4e7778078845bed3
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a2af9c49835c98fbd8a6975f9178027b57d695e3064de645e4bd042cf47d3c0c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2501AD30254201AFDB00DFA4ED8AE6977E4FB88711F540468FD88D73A0DB79AD4ADB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0504A720 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 40COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?clear@QPainterPath@@QAEXXZ.QT5GUI ref: 0504A760
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?clear@PainterPath@@
                                                                                                                                                                                                                        • String ID: QPainterPath$clear$clear(self)
                                                                                                                                                                                                                        • API String ID: 3640657333-838751274
                                                                                                                                                                                                                        • Opcode ID: 8558b706522ff44c418c1ea57fe8515d0226387ce24e40ba7d8d601cbab7e1cc
                                                                                                                                                                                                                        • Instruction ID: f14a78cbad701d910aede962ff54985bb21d95f1a3a46d60ba837d468000bf0b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8558b706522ff44c418c1ea57fe8515d0226387ce24e40ba7d8d601cbab7e1cc
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F301A2342942019FDB00DFA4EE82E5977F5FB48705F500468F948D7390DBB9AD4ADB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0509A570 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?gradient@QBrush@@QBEPBVQGradient@@XZ.QT5GUI ref: 0509A5B0
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?gradient@Brush@@Gradient@@
                                                                                                                                                                                                                        • String ID: QBrush$gradient$gradient(self) -> Optional[QGradient]
                                                                                                                                                                                                                        • API String ID: 2290157620-3144725985
                                                                                                                                                                                                                        • Opcode ID: a6a305339a412480d92993f5b3db36a3b9cfabc5ada010acc310c3fb4c8b8c9e
                                                                                                                                                                                                                        • Instruction ID: e4d67e2c116bc15ad14ea70b03413a181dc707a5d3bfbd97085a88ab79454978
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a6a305339a412480d92993f5b3db36a3b9cfabc5ada010acc310c3fb4c8b8c9e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6001D630254201AFDB11EFA4ED42E9A77E4FB44701F440464F948C3260EB75ED99EB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05034580 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?intProperty@QTextFormat@@QBEHH@Z.QT5GUI(00001FE4), ref: 050345C5
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • fontStyleStrategy, xrefs: 050345ED
                                                                                                                                                                                                                        • QTextCharFormat, xrefs: 050345F2
                                                                                                                                                                                                                        • fontStyleStrategy(self) -> QFont.StyleStrategy, xrefs: 050345E8
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?intFormat@@Property@Text
                                                                                                                                                                                                                        • String ID: QTextCharFormat$fontStyleStrategy$fontStyleStrategy(self) -> QFont.StyleStrategy
                                                                                                                                                                                                                        • API String ID: 3527681034-856114415
                                                                                                                                                                                                                        • Opcode ID: d57d4a77dad6c3c503d7b2c53d816a6f5b6b2956701d79587738910ffb9afc89
                                                                                                                                                                                                                        • Instruction ID: d3a4b62b196b633e473371af1682692d279f7247385a253e9b86aefb98fbe4ef
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d57d4a77dad6c3c503d7b2c53d816a6f5b6b2956701d79587738910ffb9afc89
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: DC01D630654201AFDB01EFA4ED42EAD77E8FB48701F444424F948C7260D7B9ED98DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050905F0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?shareContext@QOpenGLWindow@@QBEPAVQOpenGLContext@@XZ.QT5GUI ref: 05090630
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • QOpenGLWindow, xrefs: 0509065F
                                                                                                                                                                                                                        • shareContext, xrefs: 0509065A
                                                                                                                                                                                                                        • shareContext(self) -> Optional[QOpenGLContext], xrefs: 05090655
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Open$?shareContext@Context@@Window@@
                                                                                                                                                                                                                        • String ID: QOpenGLWindow$shareContext$shareContext(self) -> Optional[QOpenGLContext]
                                                                                                                                                                                                                        • API String ID: 941014937-2817937626
                                                                                                                                                                                                                        • Opcode ID: 2d672a9bb06aa4c8e68cf3cc118a4ae45b844e7fbb74f96267ab2392369ec11f
                                                                                                                                                                                                                        • Instruction ID: 6e8ced449d1beff10df31fdd1180837169554c0a90a3e1a9b6d8c686f8006700
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2d672a9bb06aa4c8e68cf3cc118a4ae45b844e7fbb74f96267ab2392369ec11f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6F01A230254201AFDB01EFA4ED42E997BE4FB48701F444464F948C7250D775ED98DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05008430 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?intProperty@QTextFormat@@QBEHH@Z.QT5GUI(0000481C), ref: 05008475
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • leftBorderStyle, xrefs: 0500849D
                                                                                                                                                                                                                        • QTextTableCellFormat, xrefs: 050084A2
                                                                                                                                                                                                                        • leftBorderStyle(self) -> QTextFrameFormat.BorderStyle, xrefs: 05008498
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?intFormat@@Property@Text
                                                                                                                                                                                                                        • String ID: QTextTableCellFormat$leftBorderStyle$leftBorderStyle(self) -> QTextFrameFormat.BorderStyle
                                                                                                                                                                                                                        • API String ID: 3527681034-267184586
                                                                                                                                                                                                                        • Opcode ID: 6f8bca8029e2190384c949ca544b33a9ed6646bb7f01e3a2e81d2fda185504e4
                                                                                                                                                                                                                        • Instruction ID: 7f950f0ab9dee184819825ebe93cafad31b55713d05bf665fd91671d9a3abc1c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6f8bca8029e2190384c949ca544b33a9ed6646bb7f01e3a2e81d2fda185504e4
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8601D670254201AFDB01EFD4ED42DA977E8FB48701F044864FA48C7250D7B9ED59DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05056700 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?maximumTouchPoints@QTouchDevice@@QBEHXZ.QT5GUI ref: 05056740
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Touch$?maximumDevice@@Points@
                                                                                                                                                                                                                        • String ID: QTextDocumentWriter$codec$codec(self) -> Optional[QTextCodec]
                                                                                                                                                                                                                        • API String ID: 2297492979-452932932
                                                                                                                                                                                                                        • Opcode ID: 719ac556516ebc9bf3013346b4e0502f591ecaee8dd4b4373a5efeb98da043c7
                                                                                                                                                                                                                        • Instruction ID: 061bb2a93b4dc753848c932f7845c48f645a216cb8d2dcf282081a7610e2393d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 719ac556516ebc9bf3013346b4e0502f591ecaee8dd4b4373a5efeb98da043c7
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5501D630254201AFDB01EFA4EE42E697BE4FB44701F440424FD48D7250D779EE58DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FFC600 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?itemPrototype@QStandardItemModel@@QBEPBVQStandardItem@@XZ.QT5GUI ref: 04FFC640
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • QStandardItemModel, xrefs: 04FFC66F
                                                                                                                                                                                                                        • itemPrototype, xrefs: 04FFC66A
                                                                                                                                                                                                                        • itemPrototype(self) -> Optional[QStandardItem], xrefs: 04FFC665
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Standard$?itemItemItem@@Model@@Prototype@
                                                                                                                                                                                                                        • String ID: QStandardItemModel$itemPrototype$itemPrototype(self) -> Optional[QStandardItem]
                                                                                                                                                                                                                        • API String ID: 2431504200-192349141
                                                                                                                                                                                                                        • Opcode ID: 8bff2253fcec98f34a54359b1b0725be1b7692b165e52caac12c0dada3caecf0
                                                                                                                                                                                                                        • Instruction ID: d578ba6584fd5dc7e10086921802838ff92340d68f1c3dc14d6fbe91ed27d21e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8bff2253fcec98f34a54359b1b0725be1b7692b165e52caac12c0dada3caecf0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4E01D630254201AFDB01DFA4ED42E5A7BE8FB84701F444424F948C7251D77AED59DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05032660 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?intProperty@QTextFormat@@QBEHH@Z.QT5GUI(00001FE0), ref: 050326A5
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • fontCapitalization, xrefs: 050326CD
                                                                                                                                                                                                                        • fontCapitalization(self) -> QFont.Capitalization, xrefs: 050326C8
                                                                                                                                                                                                                        • QTextCharFormat, xrefs: 050326D2
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?intFormat@@Property@Text
                                                                                                                                                                                                                        • String ID: QTextCharFormat$fontCapitalization$fontCapitalization(self) -> QFont.Capitalization
                                                                                                                                                                                                                        • API String ID: 3527681034-2874396441
                                                                                                                                                                                                                        • Opcode ID: 2745b1893be9ebb932466586f40bd20a2808a86581836da73441514c8e90da67
                                                                                                                                                                                                                        • Instruction ID: 66dbceb2e00b421b3717d77d7a2cb7612bcf60f788c347c62cb99bff5167a80f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2745b1893be9ebb932466586f40bd20a2808a86581836da73441514c8e90da67
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B501D631254201AFDB01EFA4ED42EA977E8FB88701F440424F948C7650D7B9EE59DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05012670 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?intProperty@QTextFormat@@QBEHH@Z.QT5GUI(00000800), ref: 050126B5
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?intFormat@@Property@Text
                                                                                                                                                                                                                        • String ID: QTextFrameFormat$position$position(self) -> QTextFrameFormat.Position
                                                                                                                                                                                                                        • API String ID: 3527681034-2199283624
                                                                                                                                                                                                                        • Opcode ID: 11603e4bd69f242addfd74c301fb8ecdaa946ddd614c219c4d55e8f3dfe61e07
                                                                                                                                                                                                                        • Instruction ID: ac85bc57db174a6ea5c6a5ebd3fbb07e2d3e578104dec97d540f83f4d66b2c43
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 11603e4bd69f242addfd74c301fb8ecdaa946ddd614c219c4d55e8f3dfe61e07
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F701D630254201AFDB01DFD4ED42E5977E9FB48701F444424F948C7250D6B9ED59DB63
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050046A0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?capStyle@QPen@@QBE?AW4PenCapStyle@Qt@@XZ.QT5GUI ref: 050046E0
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Style@$?capPen@@Qt@@
                                                                                                                                                                                                                        • String ID: QPictureIO$ioDevice$ioDevice(self) -> Optional[QIODevice]
                                                                                                                                                                                                                        • API String ID: 3055056925-2186311745
                                                                                                                                                                                                                        • Opcode ID: bfe42509659f9d0c0aea1dbe6af643652bd821bfe5985e0aad149ebe5de179e7
                                                                                                                                                                                                                        • Instruction ID: 71ca5288c85ee641c8baf608eb1d7dd481552cd0f8415a874da7e7575c20b76c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: bfe42509659f9d0c0aea1dbe6af643652bd821bfe5985e0aad149ebe5de179e7
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C3018630254201AFDB01EFA4EE42F697BE5FB48701F440464F948D7250E779ED59DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0500E540 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?parentFrame@QTextFrame@@QBEPAV1@XZ.QT5GUI ref: 0500E580
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • primaryOrientation, xrefs: 0500E5A8
                                                                                                                                                                                                                        • primaryOrientation(self) -> Qt.ScreenOrientation, xrefs: 0500E5A3
                                                                                                                                                                                                                        • QScreen, xrefs: 0500E5AD
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?parentFrame@Frame@@Text
                                                                                                                                                                                                                        • String ID: QScreen$primaryOrientation$primaryOrientation(self) -> Qt.ScreenOrientation
                                                                                                                                                                                                                        • API String ID: 3741133204-4209243269
                                                                                                                                                                                                                        • Opcode ID: 2a2d7a456ca4b3ec80b43911adb9423f19187cd95b1ca3d8e72955d7c963ef1f
                                                                                                                                                                                                                        • Instruction ID: 4186d00927c7bc667f51c668229d8ffda6d503f91ae0209598d36525eed6132f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2a2d7a456ca4b3ec80b43911adb9423f19187cd95b1ca3d8e72955d7c963ef1f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BC01F930114101AFDB01DFA4ED42E9977E9FB88711F400424F948C7350E779ED99DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05012580 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?style@QPen@@QBE?AW4PenStyle@Qt@@XZ.QT5GUI ref: 050125C0
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?style@Pen@@Qt@@Style@
                                                                                                                                                                                                                        • String ID: QPen$style$style(self) -> Qt.PenStyle
                                                                                                                                                                                                                        • API String ID: 3466556262-2426322327
                                                                                                                                                                                                                        • Opcode ID: 30aa1d76d19de1bed6ea998a10712d802ed4cec22f25f4d90c9b37feada70a96
                                                                                                                                                                                                                        • Instruction ID: d5ed2c4c51dc34b14509e6a3ce8bdeeb11329dc5d4b0aa38e216aa2a0faf3854
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 30aa1d76d19de1bed6ea998a10712d802ed4cec22f25f4d90c9b37feada70a96
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B301F430254202AFDB02EFA4ED42DA977E9FB88701F404424FD48C7220E779ED99DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FFE460 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyLong_FromUnsignedLong.PYTHON3 ref: 04FFE4AD
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: FromLongLong_Unsigned
                                                                                                                                                                                                                        • String ID: QPixelFormat$blackSize$blackSize(self) -> int
                                                                                                                                                                                                                        • API String ID: 3417993445-1030724223
                                                                                                                                                                                                                        • Opcode ID: f0725c4ada400db075ff6ebf0d3cfe7ca8b7621b7e7259369674d42fd48b7557
                                                                                                                                                                                                                        • Instruction ID: d6e8c629e98b29d2e4fbdad50c2aa2e82b7fbe4e0d405f1f3f700b1544b743d9
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f0725c4ada400db075ff6ebf0d3cfe7ca8b7621b7e7259369674d42fd48b7557
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C0014F30210200AFDB00EF64EC42E6E77E8FB48701F484468F808CB320E678ED59EB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05070720 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?loggingMode@QOpenGLDebugLogger@@QBE?AW4LoggingMode@1@XZ.QT5GUI ref: 05070760
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?loggingDebugLogger@@LoggingMode@Mode@1@Open
                                                                                                                                                                                                                        • String ID: QDrag$defaultAction$defaultAction(self) -> Qt.DropAction
                                                                                                                                                                                                                        • API String ID: 300829583-3790707491
                                                                                                                                                                                                                        • Opcode ID: 570d1a559bb3d6330e7d5314e2229f27e92fa15f5ccd89dccdf77bbfc7b93d78
                                                                                                                                                                                                                        • Instruction ID: 96b2da841fde34cdd105c520ffed6f0f4d083e05c4e92eac6afcce1872477299
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 570d1a559bb3d6330e7d5314e2229f27e92fa15f5ccd89dccdf77bbfc7b93d78
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CE01D130654202AFDB01EFA4ED42DA97BE4FB88701F400464F948D7250EBB9AD99DF52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05076770 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?units@QPageLayout@@QBE?AW4Unit@1@XZ.QT5GUI ref: 050767B0
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?units@Layout@@PageUnit@1@
                                                                                                                                                                                                                        • String ID: TouchPoint$state$state(self) -> Qt.TouchPointState
                                                                                                                                                                                                                        • API String ID: 3023184105-823003836
                                                                                                                                                                                                                        • Opcode ID: ea7789d2684d60acf017db75d0f21e5c6eda1070c3b235c535ec1fb7275a3d5e
                                                                                                                                                                                                                        • Instruction ID: b9899c860f6fc607120159a1c7bb653ce170d8ff99741113d9c26629a1031fbc
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ea7789d2684d60acf017db75d0f21e5c6eda1070c3b235c535ec1fb7275a3d5e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7601A470154202AFDB01EFA4ED42DAA7BE8FB48701F444464FD48C3660D7B9EE99DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0505E780 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?orientation@QPageLayout@@QBE?AW4Orientation@1@XZ.QT5GUI ref: 0505E7C0
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?orientation@Layout@@Orientation@1@Page
                                                                                                                                                                                                                        • String ID: QPageLayout$orientation$orientation(self) -> QPageLayout.Orientation
                                                                                                                                                                                                                        • API String ID: 2925116524-2656156900
                                                                                                                                                                                                                        • Opcode ID: 7801b64135e4d998f8e9e9799703edb4a229f4043530156026e650eb0571ea39
                                                                                                                                                                                                                        • Instruction ID: 43293fcfce2acff296e750a16ca3d9101b9990416935d1a3e0420fbd0b7ccc12
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7801b64135e4d998f8e9e9799703edb4a229f4043530156026e650eb0571ea39
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D001D130118201AFEB01EFA4ED42DA977E8FB88701F440464FD48C3250D7B9EE99DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FFE7B0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyLong_FromUnsignedLong.PYTHON3 ref: 04FFE7FD
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: FromLongLong_Unsigned
                                                                                                                                                                                                                        • String ID: QPixelFormat$hueSize$hueSize(self) -> int
                                                                                                                                                                                                                        • API String ID: 3417993445-1145287371
                                                                                                                                                                                                                        • Opcode ID: 4c693d4f247f1bd00b7380bc2721106b572e5c5ac2c79882742ef398bc3fce76
                                                                                                                                                                                                                        • Instruction ID: e2c3ca6f26059183aed92d3c1dd7d0db0979d4c6f35d9dd2095c129a0b15a849
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4c693d4f247f1bd00b7380bc2721106b572e5c5ac2c79882742ef398bc3fce76
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: FA01FF70A50201AFDB00EF64ED42E6A77E4FB48701F444468FA48DB361E678ED59DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0503A570 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 37COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(00000000), ref: 0503A5B9
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Bool_FromLong
                                                                                                                                                                                                                        • String ID: Element$isMoveTo$isMoveTo(self) -> bool
                                                                                                                                                                                                                        • API String ID: 2610644205-2266187763
                                                                                                                                                                                                                        • Opcode ID: 2ab116589bfaca491590e62ba6a48dfac04cb21c4305ceaf97377d98c753584e
                                                                                                                                                                                                                        • Instruction ID: d11417e4c8b4e923b5fbcd21b9d85d7439c35e4c61b9942375343c821b6da8be
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2ab116589bfaca491590e62ba6a48dfac04cb21c4305ceaf97377d98c753584e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D9F0F470114201AFCB00EF64ED02E5A77E4FB44601F440878F848C7250E7B9EA59DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0503A7D0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 37COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(00000000), ref: 0503A81A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Bool_FromLong
                                                                                                                                                                                                                        • String ID: Element$isLineTo$isLineTo(self) -> bool
                                                                                                                                                                                                                        • API String ID: 2610644205-3155635975
                                                                                                                                                                                                                        • Opcode ID: 83cdfe5fa64638120ba1d8c9d05476f2c197a03d84b7d10953469d2cdbc10739
                                                                                                                                                                                                                        • Instruction ID: d3a3f0d7e9601075f87f866f108a6b1023cf5aa6b3fd0b2a4d68ca3c2b19c191
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 83cdfe5fa64638120ba1d8c9d05476f2c197a03d84b7d10953469d2cdbc10739
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 63F0C874114301AFDB00EF64ED46E6A77E4FB44705F440874F988C7250E7B9EA59DB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05008760 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?devices@QTouchDevice@@SA?AV?$QList@PBVQTouchDevice@@@@XZ.QT5GUI(00000000,00000004), ref: 05008793
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Touch$?devices@Device@@Device@@@@List@malloc
                                                                                                                                                                                                                        • String ID: QTouchDevice$devices$devices() -> List[QTouchDevice]
                                                                                                                                                                                                                        • API String ID: 1641259131-1810442549
                                                                                                                                                                                                                        • Opcode ID: 5e73f1376d333b6e725138806965d4a92a0749913129d3a6d108a12134d0e6a0
                                                                                                                                                                                                                        • Instruction ID: 83e20e080869e0193f523812ff881052ef702d3a750f212b5cb82c31466e8e33
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5e73f1376d333b6e725138806965d4a92a0749913129d3a6d108a12134d0e6a0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 00F0F070254201AFEB00DBF4EC46F4A3BE4EB48300F148865FA08D72A0DBB4ED85DB20
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004045D0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 35COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetModuleFileNameW.KERNEL32(00000000,00403DA0), ref: 004045F4
                                                                                                                                                                                                                          • Part of subcall function 00408920: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000), ref: 00408970
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to get executable path., xrefs: 00404630
                                                                                                                                                                                                                        • Failed to convert executable path to UTF-8., xrefs: 00404650
                                                                                                                                                                                                                        • GetModuleFileNameW, xrefs: 00404638
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ByteCharFileModuleMultiNameWide
                                                                                                                                                                                                                        • String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
                                                                                                                                                                                                                        • API String ID: 1532159127-1977442011
                                                                                                                                                                                                                        • Opcode ID: 748dc92c4a3665e52a64521ebb29f00cda33f6c131056bcfed0b1391d42d2669
                                                                                                                                                                                                                        • Instruction ID: 0d2fa86ab14f13f7fcc6e2807861f5dff99018acd92cf068427be3d6d0997f9d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 748dc92c4a3665e52a64521ebb29f00cda33f6c131056bcfed0b1391d42d2669
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7FF031B09083008BE700BF75D14925ABAE0AB94345F548C3EE8C887285E77E85989697
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05076500 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?device@QTextDocumentWriter@@QBEPAVQIODevice@@XZ.QT5GUI ref: 05076540
                                                                                                                                                                                                                        • PyLong_FromLong.PYTHON3(00000000), ref: 05076547
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ?device@Device@@DocumentFromLongLong_TextWriter@@
                                                                                                                                                                                                                        • String ID: TouchPoint$id(self) -> int
                                                                                                                                                                                                                        • API String ID: 4235241429-2911308338
                                                                                                                                                                                                                        • Opcode ID: 5baaca6655ce9296d783ef3eef94f4660a450fe6ac431de4352e6bfcb5b4f235
                                                                                                                                                                                                                        • Instruction ID: 23f2a83f136a08096f6a3ddd5e562144dede75cab36d26651fc986bf75117eb7
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5baaca6655ce9296d783ef3eef94f4660a450fe6ac431de4352e6bfcb5b4f235
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 83F0C270544201AFDB00EFA4ED46D5E7BE8FB84701F444424F949D3250D7B9EE59DB62
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00408987 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000), ref: 00408970
                                                                                                                                                                                                                          • Part of subcall function 00402F90: GetLastError.KERNEL32 ref: 00402F98
                                                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000), ref: 004089D1
                                                                                                                                                                                                                        • calloc.MSVCRT ref: 004089EA
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ByteCharMultiWide$ErrorLastcalloc
                                                                                                                                                                                                                        • String ID: Out of memory.$win32_utils_to_utf8
                                                                                                                                                                                                                        • API String ID: 2784544953-3983694475
                                                                                                                                                                                                                        • Opcode ID: 21bcc7d080ca5c9db2f0063a8681e6bc7762e4e6dc2f13102dfe4c2287896f93
                                                                                                                                                                                                                        • Instruction ID: 7d0191ab155d1c36bf02162991644b0c6808e0cf9adbb8e4045d17a736bf9196
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 21bcc7d080ca5c9db2f0063a8681e6bc7762e4e6dc2f13102dfe4c2287896f93
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5D0119B01083028FE310AF65D55835ABBE0EB80358F01893EE4E85B3D0D7B9C5498B87
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0508A410 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 32COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ?openGLModuleType@QOpenGLContext@@SA?AW4OpenGLModuleType@1@XZ.QT5GUI ref: 0508A43B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • openGLModuleType() -> QOpenGLContext.OpenGLModuleType, xrefs: 0508A45C
                                                                                                                                                                                                                        • openGLModuleType, xrefs: 0508A461
                                                                                                                                                                                                                        • QOpenGLContext, xrefs: 0508A466
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ModuleOpen$?openContext@@Type@Type@1@
                                                                                                                                                                                                                        • String ID: QOpenGLContext$openGLModuleType$openGLModuleType() -> QOpenGLContext.OpenGLModuleType
                                                                                                                                                                                                                        • API String ID: 141884850-2688878882
                                                                                                                                                                                                                        • Opcode ID: 8261c0a9d0660545dc2e4af14337f79fd1de20042e004e5656547f27c0129a80
                                                                                                                                                                                                                        • Instruction ID: bde9b7bd28848dd5af09a9a8b299679bc60cf17ebdd49c62df4894598d8b87df
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8261c0a9d0660545dc2e4af14337f79fd1de20042e004e5656547f27c0129a80
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1AF0B430264201AFDB01DBE4EC46E5A3BE4EB44311F108465FE18C77A0DBB4AD94AB11
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00401DE6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 00403030: _errno.MSVCRT ref: 00403064
                                                                                                                                                                                                                          • Part of subcall function 00403030: strerror.MSVCRT ref: 0040306F
                                                                                                                                                                                                                        • fclose.MSVCRT ref: 00401D50
                                                                                                                                                                                                                        • fclose.MSVCRT ref: 00401D63
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to extract %s: failed to seek to the entry's data!, xrefs: 00401DF4
                                                                                                                                                                                                                        • fseek, xrefs: 00401E01
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: fclose$_errnostrerror
                                                                                                                                                                                                                        • String ID: Failed to extract %s: failed to seek to the entry's data!$fseek
                                                                                                                                                                                                                        • API String ID: 531001455-144044986
                                                                                                                                                                                                                        • Opcode ID: 05b533b50c2bc4eff8379d834af169491f677ebbb3d68f1e93d9e12fa35dd1bd
                                                                                                                                                                                                                        • Instruction ID: b1b358e5bfedda9d4d999058601c1f88ca93a78291f5d028d604a8f107234477
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 05b533b50c2bc4eff8379d834af169491f677ebbb3d68f1e93d9e12fa35dd1bd
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D2F06C756053419BCB00AF39D844299B7F1FF80318F05892FF89997390D338E985CB49
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004174C8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: atoisetlocalestrchr
                                                                                                                                                                                                                        • String ID: .
                                                                                                                                                                                                                        • API String ID: 1223908000-248832578
                                                                                                                                                                                                                        • Opcode ID: 93559f69e0f89921f206570d2a278c7facffb9e7d98682812659cee062819bc8
                                                                                                                                                                                                                        • Instruction ID: 5ece903d628136d3021f03f5de1dba085c6daeff515edd77d6e3c8bfb4f9f80e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 93559f69e0f89921f206570d2a278c7facffb9e7d98682812659cee062819bc8
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 18E08CB0A087004BD7007F39C40A35BB6E2AB80308F8A882CE4CC87701F73DC8858786
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00404DA3 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 18libraryloaderCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AddressProc$ErrorLast
                                                                                                                                                                                                                        • String ID: Failed to get address for Py_UTF8Mode$GetProcAddress$Py_UTF8Mode
                                                                                                                                                                                                                        • API String ID: 4214558900-2336683375
                                                                                                                                                                                                                        • Opcode ID: ce3f0de93563fe4047d9d5d54811ed0c466457a72e603fabebd0357acd7d67ad
                                                                                                                                                                                                                        • Instruction ID: 29490028243a8bc7eb143a8c508494385d0dcc63e20c03701c217239cd601c8a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ce3f0de93563fe4047d9d5d54811ed0c466457a72e603fabebd0357acd7d67ad
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B7E0ECB18096108AC7106F39AA5519ABBE4BA4072CF018A2EE998572C0D778A985968E
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00416DF0 Relevance: 6.1, APIs: 4, Instructions: 102COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • IsDBCSLeadByteEx.KERNEL32 ref: 00416E42
                                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32 ref: 00416E85
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Byte$CharLeadMultiWide
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2561704868-0
                                                                                                                                                                                                                        • Opcode ID: 34c0aafb8afc26c9c968cb039ac2f52e38f4d15ab9367f4157b8da4b37fd940f
                                                                                                                                                                                                                        • Instruction ID: 73686868ec51103a6e9184972a812ecf3e9551738ac5fc900f4de2194f72883f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 34c0aafb8afc26c9c968cb039ac2f52e38f4d15ab9367f4157b8da4b37fd940f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6441F5B55093518FD710DF28E48429BBBE0BF86314F158A6EF89487390D77AD889CB87
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05060770 Relevance: 6.1, APIs: 4, Instructions: 80COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyList_Size.PYTHON3(?), ref: 05060779
                                                                                                                                                                                                                        • PyList_GetItem.PYTHON3(?,00000000), ref: 050607B5
                                                                                                                                                                                                                        • ?qstrdup@@YAPADPBD@Z.QT5CORE(00000000), ref: 050607D9
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(?), ref: 050607FA
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: List_$?qstrdup@@DeallocItemSize
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 698044274-0
                                                                                                                                                                                                                        • Opcode ID: 1c01a5942846e10c26602a1c292b9048c68fa2dc940c2c636e733beb23f4207c
                                                                                                                                                                                                                        • Instruction ID: 0ca1c43094cd79b5d1b0c2f2999d829b06189172cda7aa06838bbbee1f6099c7
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1c01a5942846e10c26602a1c292b9048c68fa2dc940c2c636e733beb23f4207c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7D21C2B26412125FD7109F28FC5DA6EBBD4FF45210F140239F946C6250EB32D91ACBD2
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050327E0 Relevance: 6.1, APIs: 4, Instructions: 71COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyList_New.PYTHON3(?), ref: 050327ED
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        • ?at@?$QVector@VQPoint@@@@QBEABVQPoint@@H@Z.QT5CORE(00000000), ref: 0503281F
                                                                                                                                                                                                                        • PyList_SetItem.PYTHON3(00000000,00000000,00000000), ref: 0503284F
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(00000000), ref: 05032883
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: List_$?at@?$DeallocItemPoint@@Point@@@@Vector@malloc
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 920933346-0
                                                                                                                                                                                                                        • Opcode ID: 55a66843755359e73e664ea9716aa984be5fa04f5856296569fd1131bf6f5c10
                                                                                                                                                                                                                        • Instruction ID: accbdadb2fd044019dacef5e5fe3785fa91bb78452dc2b796be09fdc77e21a7a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 55a66843755359e73e664ea9716aa984be5fa04f5856296569fd1131bf6f5c10
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9711E479601102AFC7009B59EC8A96ABBE9FF85321F148135F909CB250DB31E816CBA1
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00401001 Relevance: 6.1, APIs: 4, Instructions: 60COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: __p__commode__p__fmode__set_app_type
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3338496922-0
                                                                                                                                                                                                                        • Opcode ID: c3091d54fea95446ff7c3ee7b6d7815346795e8d6a3ffecbbf37e06955004e2c
                                                                                                                                                                                                                        • Instruction ID: aeb446e45a19cd1e2d7087c0f9dd5afe65501be8eb4055b43830eca8bb231281
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c3091d54fea95446ff7c3ee7b6d7815346795e8d6a3ffecbbf37e06955004e2c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2B219370600201CBD314AF30D8667A737E1BB00348F55867ED4887BAA6D77ED8C6DB99
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0500E690 Relevance: 6.1, APIs: 4, Instructions: 57COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyList_New.PYTHON3(?), ref: 0500E69C
                                                                                                                                                                                                                        • PyFloat_FromDouble.PYTHON3 ref: 0500E6D4
                                                                                                                                                                                                                        • PyList_SetItem.PYTHON3(00000000,?,00000000), ref: 0500E6E4
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(00000000), ref: 0500E70C
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: List_$DeallocDoubleFloat_FromItem
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1238897676-0
                                                                                                                                                                                                                        • Opcode ID: ebfedf54eebd4602df5dba24c78939373e2939456daa5d2f86cfc462a6c19f2f
                                                                                                                                                                                                                        • Instruction ID: b66d22fce8ae9366692e2343cec8e8604b7624b0328aba718439183a1f928ba6
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ebfedf54eebd4602df5dba24c78939373e2939456daa5d2f86cfc462a6c19f2f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7E112C316001119BD7109B68F88886DBBB9FF86355B244665F819EB190FB31E457C791
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004043B0 Relevance: 6.1, APIs: 4, Instructions: 54stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: strlenstrncat
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3854678441-0
                                                                                                                                                                                                                        • Opcode ID: 024b53f308501637485ded2f28a26100731e6414f1d197708657ac8333189728
                                                                                                                                                                                                                        • Instruction ID: a1bd85adc18dd833a72da197840ca80eebc8a3fb90e726dddcfc8ac31c193ccc
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 024b53f308501637485ded2f28a26100731e6414f1d197708657ac8333189728
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 431154B160C7404EE710BF2DE88935FBBD0EB85358F064DAFE5C457346D27984848B96
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05068640 Relevance: 6.1, APIs: 4, Instructions: 53COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyList_New.PYTHON3(?), ref: 05068648
                                                                                                                                                                                                                        • PyFloat_FromDouble.PYTHON3 ref: 05068673
                                                                                                                                                                                                                        • PyList_SetItem.PYTHON3(00000000,00000000,00000000), ref: 05068688
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3(00000000), ref: 050686B3
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: List_$DeallocDoubleFloat_FromItem
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1238897676-0
                                                                                                                                                                                                                        • Opcode ID: fb582c7cbcb940e404520b2925b0b78d2ac6695f8bd26f2a4a128fa7e02521a8
                                                                                                                                                                                                                        • Instruction ID: 76ffa26069cff27d77b31db3b25588ce099d23dbdb052c6464c4c48004659844
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: fb582c7cbcb940e404520b2925b0b78d2ac6695f8bd26f2a4a128fa7e02521a8
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: DB01B5B16142024FC3109F69E88895FBFF4FF86661F244239FD46D6250EB34946A87A2
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00402CE0 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 50COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • free.MSVCRT ref: 00402D67
                                                                                                                                                                                                                        • free.MSVCRT ref: 00402D6F
                                                                                                                                                                                                                        • free.MSVCRT ref: 00402D77
                                                                                                                                                                                                                          • Part of subcall function 00408B00: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to obtain/convert traceback!, xrefs: 00402D2F
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: free$ByteCharMultiWide
                                                                                                                                                                                                                        • String ID: Failed to obtain/convert traceback!
                                                                                                                                                                                                                        • API String ID: 3219091393-982972847
                                                                                                                                                                                                                        • Opcode ID: 052f5b771e97f46218db83959d6fe6f4ff6f8b7ba96841d2be7dde76f27d9c66
                                                                                                                                                                                                                        • Instruction ID: b1da0bbaf139879325ca28b011b54c10ba95b71f8749f1078afd24c14b703eba
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 052f5b771e97f46218db83959d6fe6f4ff6f8b7ba96841d2be7dde76f27d9c66
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 380157B16097009BD700BF6A959531FFAE4AF84744F06482EF8C897381DBB898458B9A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040E7F1 Relevance: 6.0, APIs: 4, Instructions: 40COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: wcstombs$freereallocsetlocale
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3931877334-0
                                                                                                                                                                                                                        • Opcode ID: af4a0adfe83bc6257ce74bebce9e2fbec335e63f4a836b3755766f42b92495f7
                                                                                                                                                                                                                        • Instruction ID: d41dfc4cb9d2f32e5806314ff69e05ab86441aac7deb837ed49f13012e92ac7c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: af4a0adfe83bc6257ce74bebce9e2fbec335e63f4a836b3755766f42b92495f7
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 35012971E04714DBCB109F69D44139EFBF0FF88314F12896EE499A7391D37898518B96
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00408B57 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 32COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B40
                                                                                                                                                                                                                          • Part of subcall function 00402F90: GetLastError.KERNEL32 ref: 00402F98
                                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,0040301C), ref: 00408B91
                                                                                                                                                                                                                        • calloc.MSVCRT ref: 00408BAA
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ByteCharMultiWide$ErrorLastcalloc
                                                                                                                                                                                                                        • String ID: Out of memory.$win32_utils_from_utf8
                                                                                                                                                                                                                        • API String ID: 2784544953-2800126769
                                                                                                                                                                                                                        • Opcode ID: ec2cb1e5026d3fc4b67ab3b6410801d6944346cc6d37ed0befe9e1bdfa6c4f47
                                                                                                                                                                                                                        • Instruction ID: fcbae36c43b134958f39cc4fef673158ef90f98619c8ac1ec6a6b109632cf1fa
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ec2cb1e5026d3fc4b67ab3b6410801d6944346cc6d37ed0befe9e1bdfa6c4f47
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F7F04FB01083028FD300AF25D50535AB7E0BB80354F05893EE4E85B281D779D4498B86
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00402F90 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 32COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 00402F98
                                                                                                                                                                                                                          • Part of subcall function 004086F0: FormatMessageW.KERNEL32(?,?,?,?,00402FD9), ref: 0040873F
                                                                                                                                                                                                                          • Part of subcall function 004086F0: WideCharToMultiByte.KERNEL32 ref: 00408787
                                                                                                                                                                                                                          • Part of subcall function 00402DF0: MessageBoxW.USER32 ref: 00402E78
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Message$ByteCharErrorFormatLastMultiWide
                                                                                                                                                                                                                        • String ID: %s%s: %s$0$Fatal error detected
                                                                                                                                                                                                                        • API String ID: 254840284-319980707
                                                                                                                                                                                                                        • Opcode ID: 0c3db0587474ba41661a36650c9661a93dd5b94a7b7985aca411cfd2fb9549be
                                                                                                                                                                                                                        • Instruction ID: 073ad40fe3aa3b4c51d3ea82456dca4d4efc994dc50aa159961d7af2ea3959c7
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0c3db0587474ba41661a36650c9661a93dd5b94a7b7985aca411cfd2fb9549be
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3E01C0B14093419FD320AF29D58428ABBE0BF88708F01882EE4C897251DB789988CF97
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004066E0 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 14COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: calloc
                                                                                                                                                                                                                        • String ID: 0@$Cannot allocate memory for SPLASH_STATUS.$calloc
                                                                                                                                                                                                                        • API String ID: 2635317215-3108904453
                                                                                                                                                                                                                        • Opcode ID: e9ae53ffb00be03242b8a08f96269f3c0e4721a38ac4aee35946d78fdc8c9888
                                                                                                                                                                                                                        • Instruction ID: 91d9d8c6ef22e38f4f1b4844de6a5a16a8ab255c7dc3ef68476b647e8a5c5417
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e9ae53ffb00be03242b8a08f96269f3c0e4721a38ac4aee35946d78fdc8c9888
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0DD012B080E3008AC300AF21C15525E7AE4AF40704F85882EE5C557280D3BDC5959B8B
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040DB40 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 195COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Unknown pseudo relocation bit size %d., xrefs: 0040DC4C
                                                                                                                                                                                                                        • Unknown pseudo relocation protocol version %d., xrefs: 0040DDAD
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
                                                                                                                                                                                                                        • API String ID: 0-395989641
                                                                                                                                                                                                                        • Opcode ID: efeab4ecc8cf7299757ce823f27793ae6324061fd86fa164cff4e97c8fde8b6b
                                                                                                                                                                                                                        • Instruction ID: 5a79fb0c569983318be0eb92f73853d4612fcc90bcd5073555eddd72529e42a9
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: efeab4ecc8cf7299757ce823f27793ae6324061fd86fa164cff4e97c8fde8b6b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E271B175D042058BDB00DFA9D88029ABBF1FFC4344F25857AD888A7395D738A859CB8D
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 004124C4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 166COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: fputwc$memset
                                                                                                                                                                                                                        • String ID: o
                                                                                                                                                                                                                        • API String ID: 822753988-252678980
                                                                                                                                                                                                                        • Opcode ID: 9fd6ffc3a2fae0cfd560b27fc0f11d1b2788c49dfba611f968ff3f0046a73d11
                                                                                                                                                                                                                        • Instruction ID: 0dfbfd20a5ff8b44feb81e2e93b8d7a761d81825f22629ca31478565f12853d3
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9fd6ffc3a2fae0cfd560b27fc0f11d1b2788c49dfba611f968ff3f0046a73d11
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5B61F572E002198FCB14CF68D5806DEBBF1AF48350F19816AE858EB385D374E9968B94
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05080410 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ??0QShortcutEvent@@QAE@ABVQKeySequence@@H_N@Z.QT5GUI(?,?,?), ref: 05080484
                                                                                                                                                                                                                        • ??0QShortcutEvent@@QAE@ABV0@@Z.QT5GUI(?), ref: 05080505
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Event@@Shortcut$Sequence@@V0@@malloc
                                                                                                                                                                                                                        • String ID: J1i|b
                                                                                                                                                                                                                        • API String ID: 3750056953-4224118288
                                                                                                                                                                                                                        • Opcode ID: 173067816cbffd6f29ee126155e3d5893b0c94f710f22be5b8af912ef081878e
                                                                                                                                                                                                                        • Instruction ID: f471add593f9e08c0e8caf8f5d66b0825b271911041c5a73adff6975eebdff8b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 173067816cbffd6f29ee126155e3d5893b0c94f710f22be5b8af912ef081878e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8A31A175108311AFEB11DF58DC41E9BBBF5FB88710F040868F98492261EB35E958DB92
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0505E4F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(00000000), ref: 0505E583
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Bool_FromLong
                                                                                                                                                                                                                        • String ID: 1J1
                                                                                                                                                                                                                        • API String ID: 2610644205-2174808320
                                                                                                                                                                                                                        • Opcode ID: 2d202b162097b806df6055f2248a72182aa92a8e350de5bc2c55eea114ac17ff
                                                                                                                                                                                                                        • Instruction ID: 9973fcd4f072f27aaf2c657df3a23a733c24404eb7043059d44cb4f143e6f6f6
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2d202b162097b806df6055f2248a72182aa92a8e350de5bc2c55eea114ac17ff
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F52183761042009FCB11DFA8EC45EAA3BE9BB88320F544464FD59C7290E735EA99CB92
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050987A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(00000000), ref: 05098833
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Bool_FromLong
                                                                                                                                                                                                                        • String ID: 1J1
                                                                                                                                                                                                                        • API String ID: 2610644205-2174808320
                                                                                                                                                                                                                        • Opcode ID: e8a2b3dba5b887a9dd52508380aef98aa05a2699312430e1013c99d65567e9e2
                                                                                                                                                                                                                        • Instruction ID: 8ff2ad3d6901f682c81abdfb72d0d8a58e5bc8ab23f11d66f51f64735b1ebd93
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e8a2b3dba5b887a9dd52508380aef98aa05a2699312430e1013c99d65567e9e2
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A021A176204201AFCB11DFA8EC45E9A7BE5BFC8320F448869F854C7350E735E999CB92
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0501E7D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(00000000), ref: 0501E863
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Bool_FromLong
                                                                                                                                                                                                                        • String ID: 1J1
                                                                                                                                                                                                                        • API String ID: 2610644205-2174808320
                                                                                                                                                                                                                        • Opcode ID: cd0168fb9e40fef2cbb7017ad16cdf0f4b2fe4835303be08c772331d9b46f8ef
                                                                                                                                                                                                                        • Instruction ID: 229e0d15752a0f6483ffaea8ac0204d2335d9ecfd60eb2b797b18308646c1cbb
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: cd0168fb9e40fef2cbb7017ad16cdf0f4b2fe4835303be08c772331d9b46f8ef
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: AA21A3756042009FC711DFA8EC45EAE3BE5BBC8324F044464FC58C7260EB36E999CB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050947E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(00000000), ref: 05094873
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Bool_FromLong
                                                                                                                                                                                                                        • String ID: 1J1
                                                                                                                                                                                                                        • API String ID: 2610644205-2174808320
                                                                                                                                                                                                                        • Opcode ID: a1bcaceb8706f98bfef5281f7dc359e2d4b11d046426212c7c594a76a94c356e
                                                                                                                                                                                                                        • Instruction ID: 48a0b540ac8ba208a6a3dea47a645ff18c0b559cd224f95e180449cbef34dc66
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a1bcaceb8706f98bfef5281f7dc359e2d4b11d046426212c7c594a76a94c356e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0F21A375204100AFCB11DFA8EC45E9E3BE5BFC8320F444565F954C7250E735E959CB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 050246A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(00000000), ref: 05024733
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Bool_FromLong
                                                                                                                                                                                                                        • String ID: 1J1
                                                                                                                                                                                                                        • API String ID: 2610644205-2174808320
                                                                                                                                                                                                                        • Opcode ID: f964a15ff830d5702932a9f562280090f992a32525f87e9446e0875d23293763
                                                                                                                                                                                                                        • Instruction ID: 03e16145ee070aadaf87c5849bf1a819ba484b313e31da558f40b2073f07ff26
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f964a15ff830d5702932a9f562280090f992a32525f87e9446e0875d23293763
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C021B576104200AFCB11DFA8ED45EAE3BE6BFC8324F444468F958C7250D735E959CB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FEC750 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(00000000), ref: 04FEC7E3
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Bool_FromLong
                                                                                                                                                                                                                        • String ID: 1J1
                                                                                                                                                                                                                        • API String ID: 2610644205-2174808320
                                                                                                                                                                                                                        • Opcode ID: df91df396bfd90d7b9f3e3fd00979869fb293db9316d95e5111d3e8c019947db
                                                                                                                                                                                                                        • Instruction ID: af1ed45a71964c4aceb06bf1e05dd39f5388ca95b2b59ac50489be7f74f2c675
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: df91df396bfd90d7b9f3e3fd00979869fb293db9316d95e5111d3e8c019947db
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2821C7765002009FDB11DFA8EC45EAA3BE5BFC8725F044465FC58C7290E735E99ACB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 04FF04F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • _Py_Dealloc.PYTHON3 ref: 04FF05A4
                                                                                                                                                                                                                          • Part of subcall function 050DB1AD: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(050DA630,?,050DA630,0000001C), ref: 050DB1C2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Deallocmalloc
                                                                                                                                                                                                                        • String ID: EJ1
                                                                                                                                                                                                                        • API String ID: 2267669106-3528995212
                                                                                                                                                                                                                        • Opcode ID: 6f23271e03232324d9a0666d2f9c61d2675422caf8cacae5b16a2a0ee3a62140
                                                                                                                                                                                                                        • Instruction ID: 60c87f7c5e19d66f7fb5f99c1333ed88b6f8a6b08516a1b7e3d35e6c6ce5507b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6f23271e03232324d9a0666d2f9c61d2675422caf8cacae5b16a2a0ee3a62140
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9F21ADB01182019FD700EF68DC86E6A7BE5FF49320F540998F995C73A1EB75B886CB12
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 05070580 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?,?), ref: 050705ED
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Bool_FromLong
                                                                                                                                                                                                                        • String ID: 1J9
                                                                                                                                                                                                                        • API String ID: 2610644205-2407233842
                                                                                                                                                                                                                        • Opcode ID: 1f7bd74c1ebb1bd189b5d580bcc4a6f1de6fa05361d318d610cf9fade01dd244
                                                                                                                                                                                                                        • Instruction ID: a41900ac67f08d6d85776a0e96465187a5d9c459e99ddada3089baee3f686a5f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1f7bd74c1ebb1bd189b5d580bcc4a6f1de6fa05361d318d610cf9fade01dd244
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 96113F75504205AFCB21DF68FC15DAE3BE1BF84715F444564F848872A0E735D958CF92
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0507A690 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PyBool_FromLong.PYTHON3(?,?), ref: 0507A6FD
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3547989930.0000000004FE1000.00000020.00000001.01000000.00000024.sdmp, Offset: 04FE0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3547917144.0000000004FE0000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548157637.00000000050DD000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548286578.000000000517B000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548340045.0000000005193000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548385406.0000000005194000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548439671.000000000519E000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548489941.00000000051A7000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548547092.00000000051A8000.00000008.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548589294.00000000051A9000.00000004.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3548634401.00000000051AB000.00000002.00000001.01000000.00000024.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_4fe0000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Bool_FromLong
                                                                                                                                                                                                                        • String ID: 1J9
                                                                                                                                                                                                                        • API String ID: 2610644205-2407233842
                                                                                                                                                                                                                        • Opcode ID: 855fcc5ec823075ddb49f65e67ae0e2ee6cb0d72df19dc407fbde9ecd78393a8
                                                                                                                                                                                                                        • Instruction ID: 0316333152c59b77d19a203d03573784a8feecb022067fb18d35672977d4009e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 855fcc5ec823075ddb49f65e67ae0e2ee6cb0d72df19dc407fbde9ecd78393a8
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D8112975604200AFCB11ABA8FC46EAE3BF1BF84711F480568F849872E0EB35DD59CB52
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040D8E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Unknown error, xrefs: 0040D8E2
                                                                                                                                                                                                                        • _matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 0040D92F
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: fprintf
                                                                                                                                                                                                                        • String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                                        • API String ID: 383729395-3474627141
                                                                                                                                                                                                                        • Opcode ID: f74ba067b4a2145830e725ba5a059d72fea62b42937aab84030ba012b91b4e73
                                                                                                                                                                                                                        • Instruction ID: d090ae441ae7ed191b2c3bbd373a08a5730f8df06674ae97c57d609341765c89
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f74ba067b4a2145830e725ba5a059d72fea62b42937aab84030ba012b91b4e73
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: DD01E4B0508B85DBD300AF15E48845AFFF1FF89350F82889DF5C846269CB36D8A8C74A
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00401D7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to extract %s: failed to open archive file!, xrefs: 00401DA4
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: fclose$_wfopenfreemalloc
                                                                                                                                                                                                                        • String ID: Failed to extract %s: failed to open archive file!
                                                                                                                                                                                                                        • API String ID: 409134274-2950503014
                                                                                                                                                                                                                        • Opcode ID: bc8c0f40a64667b258747b891fccd1e7d42742d54face0fde24ed5700ed4ad79
                                                                                                                                                                                                                        • Instruction ID: 7614606d81e887eecfecfed5343dc5ca5952679920abc2288eb417914ad53e33
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: bc8c0f40a64667b258747b891fccd1e7d42742d54face0fde24ed5700ed4ad79
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 93F01DB5A043059BDB00AF35E84419AB7E1BF80318F01893EE898DB391E738D8858B86
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00415E10 Relevance: 5.1, APIs: 4, Instructions: 55sleepCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • Sleep.KERNEL32(?,?,?,?,00415F41,?,?,?,?,?,?,00000000,004142E4), ref: 00415E37
                                                                                                                                                                                                                        • InitializeCriticalSection.KERNEL32(?,?,?,?,00415F41,?,?,?,?,?,?,00000000,004142E4), ref: 00415E74
                                                                                                                                                                                                                        • InitializeCriticalSection.KERNEL32(?,?,?,?,?,00415F41,?,?,?,?,?,?,00000000,004142E4), ref: 00415E80
                                                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(?,?,?,?,00415F41,?,?,?,?,?,?,00000000,004142E4), ref: 00415EA8
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CriticalSection$Initialize$EnterSleep
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1117354567-0
                                                                                                                                                                                                                        • Opcode ID: d7b42fd4e733c284aa8614d4c2843ab90d0827d89210ebc45ef6cd9b7a9f8079
                                                                                                                                                                                                                        • Instruction ID: 8d4cea6e3eae5d5154d2418d5b7341923ef78fd17797a7ba2a2094ec0acf5e62
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d7b42fd4e733c284aa8614d4c2843ab90d0827d89210ebc45ef6cd9b7a9f8079
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: FC113771804604CBDB65AB2CE9D51EF37A4F740300F652636D445C7324E779D9C8C69E
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 0040DFE0 Relevance: 5.0, APIs: 4, Instructions: 39COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(?,?,?,?,?,?,0040E1AB,?,?,?,?,?,0040D818), ref: 0040DFEE
                                                                                                                                                                                                                        • TlsGetValue.KERNEL32(?,?,?,?,?,?,?,0040E1AB,?,?,?,?,?,0040D818), ref: 0040E015
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,0040E1AB,?,?,?,?,?,0040D818), ref: 0040E01C
                                                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,0040E1AB,?,?,?,?,?,0040D818), ref: 0040E03C
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CriticalSection$EnterErrorLastLeaveValue
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 682475483-0
                                                                                                                                                                                                                        • Opcode ID: be30760642f5f923f25c22eccc3533437ca06620e5a78a3e64c9a32c5ac432c0
                                                                                                                                                                                                                        • Instruction ID: ec43abde3d5bb8c9cd3b17ef075de6dc33701065addaa06d31121f0b361238c5
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: be30760642f5f923f25c22eccc3533437ca06620e5a78a3e64c9a32c5ac432c0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6FF028B55003118BD710BF79E8C890B7BF4EB04740F0505B9DD848B325E774AC19CBAA
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%

                                                                                                                                                                                                                        Function 00406720 Relevance: 5.0, APIs: 4, Instructions: 29COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • free.MSVCRT(-00000004,00720E1C,00000002), ref: 0040673C
                                                                                                                                                                                                                        • free.MSVCRT(-00000004,00720E1C,00000002), ref: 0040674E
                                                                                                                                                                                                                        • free.MSVCRT(-00000004,00720E1C,00000002), ref: 00406760
                                                                                                                                                                                                                        • free.MSVCRT(-00000004,00720E1C,00000002), ref: 00406768
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.3539878500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539826529.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539934311.0000000000419000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3539986600.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540187457.0000000000432000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.3540237837.0000000000435000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: free
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1294909896-0
                                                                                                                                                                                                                        • Opcode ID: f1f19a07b2916ba5163eaa3879dfc33869d61147520d0c246ce0b263a20fc7fb
                                                                                                                                                                                                                        • Instruction ID: 7fa97c1622dad13d69692f5ac932c0fb64940c2aa2579b211d90da9c96ec3935
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f1f19a07b2916ba5163eaa3879dfc33869d61147520d0c246ce0b263a20fc7fb
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 34F0FEB56143004BDF20BF35B4C565A7BE4AF00748F4B087DED85AB242E738D8908B69
                                                                                                                                                                                                                        Uniqueness

                                                                                                                                                                                                                        Uniqueness Score: -1.00%